splunk dynamic drilldown shows variable instead of value

[sanchitguptaiit]

I am trying to define a drilldown within a splunk form. However, when i click the row, it passes the variable $row.rid$ instead of the value.

Can someone where help what i am doing wrong?

Here is the code

 <panel>
      <table>
        <title>Error Details</title>
        <search>
          <query>host="vmh001d009" index="coreservices"  | transaction rid | search (level=ERROR OR level=FATAL)  | rex field=url "http://(?<Service>[^/]+/[^/]+)" | eval Time=strftime(_time, "%H:%M %P %Z") | table Time, Service, funcname, user | rename funcname as Function, user as User</query>
          &lt;earliest&gt;$timeSelection.earliest$&lt;/earliest&gt;
          &lt;latest&gt;$timeSelection.latest$&lt;/latest&gt;
        </search>
        <drilldown>
          &lt;link&gt;/app/coreservicesmonitoring/ptpe__debug?form.rid=$row.rid$&lt;/link&gt;
        </drilldown>
        <option name="wrap">false</option>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
        <option name="drilldown">row</option>
      </table>
    </panel>

Here is what it resolves too; (note form.rid=%24row.rid%24 )

https://prodsplunk/en-US/app/coreservicesmonitoring/ptpe__debug?form.rid=%24row.rid%24&form.time.ear...

[gyslainlatsa · Accepted solution]

hi sanchitguptaiitd,

For this to work, there will have to be rida field that appears in the final table and you have displayed among the fields you want to display with the control table, I see no rid.
for the syntax of the drilldown tag, everything is correct and should work.
try as I say, and let me know.

Here the sample code I used recently and it retrieves the exact value.

 <panel>
      <table id="master">
        <title>Tickets for $host$, $status$, generated by Error_alert, triggered</title>
        <search>
          <query>index=ticket report="ticket1" $host$ $TicketNumber$ $status$ $comment$ |dedup TicketNumber
             |table TicketNumber Alerttime status Comments Raw 
          </query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>

        <drilldown>
          <!-- Use set to specify the new token to be created.
            Use any token from the page or from the click event to produce the value needed. -->  
          <link>/app/CPU/tickets_list2?form.TicketNumber=$row.TicketNumber$</link>
        </drilldown>
        <option name="count">10</option>
      </table>
    </panel>

please forgive My english

[sanchitguptaiit]

thanks, that worked! i assumed i could use any fields in underlying event, guess only those shown up in table can be passed.

Thanks again for your help

[gyslainlatsa]

thanks, If it works; must then accepted