Splunk Search

Click Selection not working.

jerinvarghese
Communicator

Hi All,

I have a code, that uses the output to fetch data from another Panel.

First Panel

 

<title>Juniper Mnemonics</title>
      <table>
        <search>
          <query>index=nw_syslog
| search hostname="*DCN*"
| stats count by cisco_mnemonic, hostname
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition field="cisco_mnemonic">
            <set token="message_token">$click.value$</set>
          </condition>
          <condition field="hostname">
            <set token="hostname_token">$click.value$</set>
          </condition>
          <condition field="count"></condition>
        </drilldown>
      </table>

 

 

From this panel 2 contents are fetched for second panel search.


Second Panel

 

index=nw_syslog
| search hostname="*DCN*"
| search cisco_mnemonic="$message_token$"
| search hostname="$hostname_token$"
| stats count by message
| sort - count

 

 

Issue: 

When ever i click the first panel table.( given ROW as Click Selection). its not getting fetching correctly.

Only fetching "cisco_mnemonic" only for both cisco_mnemonic and hostname. Please guide me how can i get both in single click.

 

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think the root cause of the problem is setting each token to the same value ($click.value$).  Have you tried something like this?

        <drilldown>
          <condition field="cisco_mnemonic">
            <set token="message_token">$row.cisco_mnemonic$</set>
          </condition>
          <condition field="hostname">
            <set token="hostname_token">$row.hostname$</set>
          </condition>
          <condition field="count"></condition>
        </drilldown>
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

ashvinpandey
Contributor

@jerinvarghese Change your drilldown tag in the first panel as shown below:

 

        <drilldown>
          <set token="message_token">$row.cisco_mnemonic$</set>
          <set token="hostname_token">$row.hostname$</set>
        </drilldown>

 

If this didn't work you must also try the solution given by @richgalloway 
Also if this reply helped you in solving your problem, an up-vote would be appreciated.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think the root cause of the problem is setting each token to the same value ($click.value$).  Have you tried something like this?

        <drilldown>
          <condition field="cisco_mnemonic">
            <set token="message_token">$row.cisco_mnemonic$</set>
          </condition>
          <condition field="hostname">
            <set token="hostname_token">$row.hostname$</set>
          </condition>
          <condition field="count"></condition>
        </drilldown>
---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...