Splunk Dev

How do I assign dropdown links in a table with events from two sourcetypes where one of them is an inputlookup and the other one is a regular index search?

Aishwaryagirish
Engager

For example, the table is like this
time description vendor1
time description vendor2
time description vendor1
When I click vendor1-its a regular index based search. But vendor 2, it should go the search based on inputlookup.
Please help. Thanks

Tags (1)
0 Karma

woodcock
Esteemed Legend

To build on what @dal said, you would do something like this:

| eval _search_str=if(vendor=="vendor1", "vendor1 SPL here", "vendor2 SPL here")

Then reference _search_str in your drilldown.

0 Karma

DalJeanis
Legend

You will need to add another, hidden column, which identifies what kind of search it should, and creates the appropriate search language. Here's an answer that describes it a little more fully -

https://answers.splunk.com/answers/26825/drilldown-from-a-hidden-column.html

Presumably there will be more than two vendors in your dropdown, so that method will be the most appropriate. If there were only two, then use radio buttons, and have the radio button set the search language.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...