Splunk Search

How to enable drilldown for only one column in the table of multiple fields?

knanaiah001
Explorer

Hi,

Can someone suggest me on how to enable drilldown for specific column .
For example ,if i have 5 columns and i have to enable drilldown on 3rd column how this can be achieved 

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust
 <option name="drilldown">cell</option>
        <drilldown>
          <condition field="sourcetype">
            <set token="sourcetype">$click.value2$</set>
            </condition>
          <condition field="*">
          </condition>
 </drilldown>

The above code let user to drilldown only on field "sourcetype". The remaining fields will be clickable but no action will be taken because of "field=*"

————————————
If this helps, give a like below.
0 Karma

knanaiah001
Explorer

Any suggestions please?

0 Karma

vik
Explorer

Did you find any solution ? 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@vik Did you try my solution?

————————————
If this helps, give a like below.
0 Karma

vik
Explorer

@thambisetty  Yes, I tried your solution it helps. But I am also trying to have the link disabled for the rest of the columns. 

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...