I have 4 Single Values that show different values, and I want to be able to click on each of them and then bring up a table below showing my information. I currently have this set for one of the single values, which shows the number of failed MFA challenges. So when that value is clicked, a table opens up to display the account id, email address, another id number and a timestamp.
Here is the code for the single value:
index=keycloak "MFA"
| regex _raw="MFA challenge failed"
| stats count
and here is the code I have for the statistics table that opens when the single value is clicked:
index=keycloak "MFA"
| eval ONE="$failed$"
| rex "account\s+(?<account>\w+)\s+with\s+email\s+(?<email>[^ ]+)\s+\w+\s+\w+\s+\w+\s+\w+\s+(?<keycloak_id>[a-z,0-9,-]+)"
| where isnotnull (account)
| table account, email, keycloak_id, _time
The eval ONE="$failed$" is corresponding to the drilldown editor for the single value, which is as follows:
On Click: Manage tokens on this dashboard
Set failed = $click.value2$
