How to split a multivalue result from stats values() into individual rows?

[BrentRiva]

I'm using stats values(series) to print a list of all the indexes of a specific line of business. Specifically the search is:

<searchTemplate>index="_internal" cost_center=$LOB$ | stats values(series) as "LOB Splunk Indices"</searchTemplate>

I want to be able to click on a specific index in the returned list of indexes, and I want to have it so it does a new search on the given index. However, when I use 'row.<fieldname>' for my drilldown it sends all of the indexes to my form search.

Is there anyway to set it so that it only sends exactly the value the user clicks? Click.value did the same thing for me, but I'd be willing to try it again if you're sure that's how. My thinking is I need to split them up into individual rows, but I'm not sure how.

Thanks!

[emiller42 · Accepted solution]

Couple things here:

1. Instead of stats, why not dedup? index="_internal" cost_center=$LOB$ | dedup series | table series | rename series as "LOB Splunk Indices" This will give you one row per value, instead of a single multivalued field.
2. You can turn a multi-valued field into explicit records with the mvexpand command. index="_internal" cost_center=$LOB$ | stats values(series) as series | mvexpand series | rename series as "LOB Spunk Indices"

[BrentRiva]

Wow! That worked perfectly (#1). Thank you so much for the quick reply. That was one of the last things I needed to finish this dashboard.