Splunk Search

Click Selection not working.

jerinvarghese
Communicator

Hi All,

I have a code, that uses the output to fetch data from another Panel.

First Panel

 

<title>Juniper Mnemonics</title>
      <table>
        <search>
          <query>index=nw_syslog
| search hostname="*DCN*"
| stats count by cisco_mnemonic, hostname
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition field="cisco_mnemonic">
            <set token="message_token">$click.value$</set>
          </condition>
          <condition field="hostname">
            <set token="hostname_token">$click.value$</set>
          </condition>
          <condition field="count"></condition>
        </drilldown>
      </table>

 

 

From this panel 2 contents are fetched for second panel search.


Second Panel

 

index=nw_syslog
| search hostname="*DCN*"
| search cisco_mnemonic="$message_token$"
| search hostname="$hostname_token$"
| stats count by message
| sort - count

 

 

Issue: 

When ever i click the first panel table.( given ROW as Click Selection). its not getting fetching correctly.

Only fetching "cisco_mnemonic" only for both cisco_mnemonic and hostname. Please guide me how can i get both in single click.

 

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think the root cause of the problem is setting each token to the same value ($click.value$).  Have you tried something like this?

        <drilldown>
          <condition field="cisco_mnemonic">
            <set token="message_token">$row.cisco_mnemonic$</set>
          </condition>
          <condition field="hostname">
            <set token="hostname_token">$row.hostname$</set>
          </condition>
          <condition field="count"></condition>
        </drilldown>
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

ashvinpandey
Contributor

@jerinvarghese Change your drilldown tag in the first panel as shown below:

 

        <drilldown>
          <set token="message_token">$row.cisco_mnemonic$</set>
          <set token="hostname_token">$row.hostname$</set>
        </drilldown>

 

If this didn't work you must also try the solution given by @richgalloway 
Also if this reply helped you in solving your problem, an up-vote would be appreciated.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think the root cause of the problem is setting each token to the same value ($click.value$).  Have you tried something like this?

        <drilldown>
          <condition field="cisco_mnemonic">
            <set token="message_token">$row.cisco_mnemonic$</set>
          </condition>
          <condition field="hostname">
            <set token="hostname_token">$row.hostname$</set>
          </condition>
          <condition field="count"></condition>
        </drilldown>
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...