Splunk Search

Click Selection not working.

jerinvarghese
Communicator

Hi All,

I have a code, that uses the output to fetch data from another Panel.

First Panel

 

<title>Juniper Mnemonics</title>
      <table>
        <search>
          <query>index=nw_syslog
| search hostname="*DCN*"
| stats count by cisco_mnemonic, hostname
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition field="cisco_mnemonic">
            <set token="message_token">$click.value$</set>
          </condition>
          <condition field="hostname">
            <set token="hostname_token">$click.value$</set>
          </condition>
          <condition field="count"></condition>
        </drilldown>
      </table>

 

 

From this panel 2 contents are fetched for second panel search.


Second Panel

 

index=nw_syslog
| search hostname="*DCN*"
| search cisco_mnemonic="$message_token$"
| search hostname="$hostname_token$"
| stats count by message
| sort - count

 

 

Issue: 

When ever i click the first panel table.( given ROW as Click Selection). its not getting fetching correctly.

Only fetching "cisco_mnemonic" only for both cisco_mnemonic and hostname. Please guide me how can i get both in single click.

 

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think the root cause of the problem is setting each token to the same value ($click.value$).  Have you tried something like this?

        <drilldown>
          <condition field="cisco_mnemonic">
            <set token="message_token">$row.cisco_mnemonic$</set>
          </condition>
          <condition field="hostname">
            <set token="hostname_token">$row.hostname$</set>
          </condition>
          <condition field="count"></condition>
        </drilldown>
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

ashvinpandey
Contributor

@jerinvarghese Change your drilldown tag in the first panel as shown below:

 

        <drilldown>
          <set token="message_token">$row.cisco_mnemonic$</set>
          <set token="hostname_token">$row.hostname$</set>
        </drilldown>

 

If this didn't work you must also try the solution given by @richgalloway 
Also if this reply helped you in solving your problem, an up-vote would be appreciated.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think the root cause of the problem is setting each token to the same value ($click.value$).  Have you tried something like this?

        <drilldown>
          <condition field="cisco_mnemonic">
            <set token="message_token">$row.cisco_mnemonic$</set>
          </condition>
          <condition field="hostname">
            <set token="hostname_token">$row.hostname$</set>
          </condition>
          <condition field="count"></condition>
        </drilldown>
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...