Splunk Search

How to change the search based on a clicked table value?

canar40
Engager

Newbie here so please bear with me 🙂
I created a table using stats count with 3 columns.
alt text

What I also did is to dynamically change the search to search on what I clicked. Afterwards, I use timechart count to display the results based on the opposite, e.g. if I click on a 10653_10_99, the time chart would be by "Bag verloren geraakt". The code:

index=wincc Type=2 Text1="Backbone"  State=3 |
rename Text5 as CI |  rename Text6 as Omschrijving |
search $columnName2$ = "$columnPicker2$" |
eval sortByTheOpposite = case("$columnName2$"=="Omschrijving",CI,"$columnName2$"=="CI", Omschrijving) |
timechart count by sortByTheOpposite useother=f limit=10

This works if I click on one of the first two columns. Now I want to dynamically change my search/time chart if I click on a value in the third column. This would require a string of type "search CI = "XX" AND Omschrijving = "YY" "
For this, I was planning to use click.name and row.Omschrijving and get the XX and YY values, however I cannot incorporate in the case the brackets. Any ideas of a work around? Thank you very much in advance!

0 Karma
1 Solution

canar40
Engager

For those interested, we fixed it this way:

<drilldown>
    <condition field="CI">
    <set token="columnName1">$click.name2$</set>
    <set token="valueName1">$click.value2$</set>
    </condition>
</drilldown>

Then you create a panel depending on a certain token:

<panel depends="valueName1">
</panel>

View solution in original post

canar40
Engager

For those interested, we fixed it this way:

<drilldown>
    <condition field="CI">
    <set token="columnName1">$click.name2$</set>
    <set token="valueName1">$click.value2$</set>
    </condition>
</drilldown>

Then you create a panel depending on a certain token:

<panel depends="valueName1">
</panel>
Get Updates on the Splunk Community!

What's New in Splunk Observability - November 2025

Feature Highlight  Analyze your dimensions and metrics with Usage Analytics  To help optimize telemetry data ...

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...