How add stats table to each row in a stats table

[rkishoreqa]

I built a dashboard to view the stats count of applications with the below query.

Query : index="bw6_stg" ErrorReport| rex field=_raw "ApplicationName:\s+\[(?P<Applname>.*)];" | rex field=_raw "jobId: (?<jId>\w+);" |dedup jId |stats count by Applname

For the above query below are the results.

Applname       Error count
abcd                     5
abcd.app            6
efgh                     4
efgh.app            3

Now my requirement is to add stats count of errors for each application this stats table like as below.
When I click on the 1st application, it should show us like below.

Applname       Error count
abcd                     5
     Error1                  2
     Error2                  1
     Error3                   2

When I click on the 2nd application, it should show us like below.

Applname       Error count
abcd .app                    6
     Error1                  2
     Error2                  2
     Error3                   2

can you anyone please help me on this, Thanks in advance

[nickhills · Accepted solution]

Use $row.<fieldname>$ in your drilldown.

In your case that is probably something like $row.ApplName$

See https://docs.splunk.com/Documentation/Splunk/8.1.0/Viz/PanelreferenceforSimplifiedXML#Predefined_dri...

[rkishoreqa]

The second panel needs to get application name from 1st panel, what we selected.

[rkishoreqa]

My requirement is to display stats count table on ApplicationName and when I clicked on the ApplicationName it should display Errors count as stats count table.

Applname       Error count
abcd                     5
     Error1                  2
     Error2                  1
     Error3                   2

abcd .app                    6
     Error1                  2
     Error2                  2
     Error3                   2

[nickhills]

Is your question:

"what should the search string be for the second panel?"

or is it:

"how do i make a click in one panel affect the contents of another panel?"

If you want to know how to make another panel appear and be driven by the click see this answer:

https://community.splunk.com/t5/Splunk-Search/Can-you-display-a-panel-only-if-the-user-clicks-on-one...

[rkishoreqa]

The second panel needs to get application name from 1st panel, what we selected.

My requirement is to display stats count table on ApplicationName and when I clicked on the ApplicationName it should display Errors count as stats count table.

Applname       Error count
abcd                     5
     Error1                  2
     Error2                  1
     Error3                   2

abcd .app                    6
     Error1                  2
     Error2                  2
     Error3                   2