Splunk Search

Click Selection not working.

jerinvarghese
Communicator

Hi All,

I have a code, that uses the output to fetch data from another Panel.

First Panel

 

<title>Juniper Mnemonics</title>
      <table>
        <search>
          <query>index=nw_syslog
| search hostname="*DCN*"
| stats count by cisco_mnemonic, hostname
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition field="cisco_mnemonic">
            <set token="message_token">$click.value$</set>
          </condition>
          <condition field="hostname">
            <set token="hostname_token">$click.value$</set>
          </condition>
          <condition field="count"></condition>
        </drilldown>
      </table>

 

 

From this panel 2 contents are fetched for second panel search.


Second Panel

 

index=nw_syslog
| search hostname="*DCN*"
| search cisco_mnemonic="$message_token$"
| search hostname="$hostname_token$"
| stats count by message
| sort - count

 

 

Issue: 

When ever i click the first panel table.( given ROW as Click Selection). its not getting fetching correctly.

Only fetching "cisco_mnemonic" only for both cisco_mnemonic and hostname. Please guide me how can i get both in single click.

 

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think the root cause of the problem is setting each token to the same value ($click.value$).  Have you tried something like this?

        <drilldown>
          <condition field="cisco_mnemonic">
            <set token="message_token">$row.cisco_mnemonic$</set>
          </condition>
          <condition field="hostname">
            <set token="hostname_token">$row.hostname$</set>
          </condition>
          <condition field="count"></condition>
        </drilldown>
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

ashvinpandey
Contributor

@jerinvarghese Change your drilldown tag in the first panel as shown below:

 

        <drilldown>
          <set token="message_token">$row.cisco_mnemonic$</set>
          <set token="hostname_token">$row.hostname$</set>
        </drilldown>

 

If this didn't work you must also try the solution given by @richgalloway 
Also if this reply helped you in solving your problem, an up-vote would be appreciated.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think the root cause of the problem is setting each token to the same value ($click.value$).  Have you tried something like this?

        <drilldown>
          <condition field="cisco_mnemonic">
            <set token="message_token">$row.cisco_mnemonic$</set>
          </condition>
          <condition field="hostname">
            <set token="hostname_token">$row.hostname$</set>
          </condition>
          <condition field="count"></condition>
        </drilldown>
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...