1 Solution
Hi,
I'm not sure if I can give you the answer that you're looking for, but I might be able to point you in the direction of some places to look.
I think when posting your question, you didn't quite get all the formatting as code so it's a bit broken. No worries, we'll try to figure it out.
Some things to note:
You can't use
<fieldset></fieldset>tags within the<drilldown></drilldown>Event Handler.
Check this out in the docs: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#drilldownThe
<condition></condition>element works slightly differently in<drilldown></drilldown>. You can't use it with amatchcommand.
Have a look here: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#Condition_.28drilldown....
One strategy you could try would be to create an <input type="dropdown"></input> and populate it with a search that lists all of your HostNames
Then you could use <change></change> and <condition></condition> elements to create your Prefixhost token.
Alternatively, if you want to use the <table></table> and <drilldown></drilldown> approach, you could eval the correct Macro Name into the search.
Then when your users click on a row, you can take that Macro Name token and use it to create later searches.
Like this:
I know that this may not be exactly what you're looking for, but it might spark some ideas.
Finally, if you haven't come across it yet in your Splunk journey, check out the excellent 'Dashboard Examples App' on Splunkbase. Install it on a test system, and use it as a reference for what's possible. You can find it here: https://splunkbase.splunk.com/app/1603/
Best of luck.
Here's the code for that example, which you could paste into a new Dashboard just to see what I mean
(You can ignore the search, that was just to create some data to work with):
<dashboard>
<label>Test - Table Drilldown</label>
<row>
<panel>
<title>My Data</title>
<table>
<search>
<query>
<![CDATA[| makeresults
| fields - _time
| eval HostName=mvappend("CH1234", "/1234", "ATC1234", "L1234", "1CP", "W1234")
| mvexpand HostName
| eval Time=strftime(time(),"%H:%M:%S %d/%m/%Y"), OtherTime=strftime(time()+121,"%H:%M:%S %d/%m/%Y")
| eval Environment=case(match(HostName,"^CH.*"),"US_Macro",match(HostName,"^/\d.*|^ATC.*|^L.*|^\dCP.*|^W.*"),"AD_Macro")
| table HostName Time OtherTime Environment
]]>
</query>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="my.click.name">$click.name$</set>
<set token="my.click.value">$click.value$</set>
<set token="my.click.name2">$click.name2$</set>
<set token="my.click.value2">$click.value2$</set>
<set token="my.row.hostname">$row.HostName$</set>
<set token="my.row.time">$row.Time$</set>
<set token="my.row.othertime">$row.OtherTime$</set>
<set token="my.row.environment">$row.Environment$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
<div>click.name = $my.click.name$</div>
<div>click.value = $my.click.value$</div>
<div>click.name2 = $my.click.name2$</div>
<div>click.value2 = $my.click.value2$</div>
<div>row.HostName = $my.row.hostname$</div>
<div>row.Time = $my.row.time$</div>
<div>row.OtherTime = $my.row.othertime$</div>
<h3>row.Environment = $my.row.environment$</h3>
<h3>Run this search: $my.row.environment$_Process($my.row.hostname$)</h3>
</html>
</panel>
</row>
</dashboard>
Hi,
I'm not sure if I can give you the answer that you're looking for, but I might be able to point you in the direction of some places to look.
I think when posting your question, you didn't quite get all the formatting as code so it's a bit broken. No worries, we'll try to figure it out.
Some things to note:
You can't use
<fieldset></fieldset>tags within the<drilldown></drilldown>Event Handler.
Check this out in the docs: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#drilldownThe
<condition></condition>element works slightly differently in<drilldown></drilldown>. You can't use it with amatchcommand.
Have a look here: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#Condition_.28drilldown....
One strategy you could try would be to create an <input type="dropdown"></input> and populate it with a search that lists all of your HostNames
Then you could use <change></change> and <condition></condition> elements to create your Prefixhost token.
Alternatively, if you want to use the <table></table> and <drilldown></drilldown> approach, you could eval the correct Macro Name into the search.
Then when your users click on a row, you can take that Macro Name token and use it to create later searches.
Like this:
I know that this may not be exactly what you're looking for, but it might spark some ideas.
Finally, if you haven't come across it yet in your Splunk journey, check out the excellent 'Dashboard Examples App' on Splunkbase. Install it on a test system, and use it as a reference for what's possible. You can find it here: https://splunkbase.splunk.com/app/1603/
Best of luck.
Here's the code for that example, which you could paste into a new Dashboard just to see what I mean
(You can ignore the search, that was just to create some data to work with):
<dashboard>
<label>Test - Table Drilldown</label>
<row>
<panel>
<title>My Data</title>
<table>
<search>
<query>
<![CDATA[| makeresults
| fields - _time
| eval HostName=mvappend("CH1234", "/1234", "ATC1234", "L1234", "1CP", "W1234")
| mvexpand HostName
| eval Time=strftime(time(),"%H:%M:%S %d/%m/%Y"), OtherTime=strftime(time()+121,"%H:%M:%S %d/%m/%Y")
| eval Environment=case(match(HostName,"^CH.*"),"US_Macro",match(HostName,"^/\d.*|^ATC.*|^L.*|^\dCP.*|^W.*"),"AD_Macro")
| table HostName Time OtherTime Environment
]]>
</query>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="my.click.name">$click.name$</set>
<set token="my.click.value">$click.value$</set>
<set token="my.click.name2">$click.name2$</set>
<set token="my.click.value2">$click.value2$</set>
<set token="my.row.hostname">$row.HostName$</set>
<set token="my.row.time">$row.Time$</set>
<set token="my.row.othertime">$row.OtherTime$</set>
<set token="my.row.environment">$row.Environment$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
<div>click.name = $my.click.name$</div>
<div>click.value = $my.click.value$</div>
<div>click.name2 = $my.click.name2$</div>
<div>click.value2 = $my.click.value2$</div>
<div>row.HostName = $my.row.hostname$</div>
<div>row.Time = $my.row.time$</div>
<div>row.OtherTime = $my.row.othertime$</div>
<h3>row.Environment = $my.row.environment$</h3>
<h3>Run this search: $my.row.environment$_Process($my.row.hostname$)</h3>
</html>
</panel>
</row>
</dashboard>
