I am looking for a solution to a splunk panel when I try to click on any cell value it should open events related to
that cell value, instead its opening all event values. settings on drill down click is set to cell. Please suggest any workable solution for problem.
index= xxx | eval code = some condition | eval Res = some condition | Stats count(eval(Res='success')) As Success count(eval(Res='failure')) As Failures by name | sort by count desc . the below 5 columns are pulled with some row entries.(settings on drilldown is cell enabled but still cant achieve the required solution)
name code. success failures count
xxxx 1234 50 60 110
yyyy 4312 70 80 150
zzzz 5678 80 50 130
as mentioned above when clicked on cell 50 at row1, it should retrieve only 50 success events, similarly when clicked at 50 at row3, it should retrieve only 50 failures events.