Hi There,
I have two queries [Query 1 and Query 2]. what i am planning to achieve is that when user clicks on the server_ID for tabular output of Query 1, then it should be passed as INPUT to the WHERE clause in Query 2 . Any help would be appreciated.
Query 1:
index=<<index_name>> sourcetype=webserver | dedup server_ID | table server_ID
Query 1 Output:
server_ID
49552473-567 |
d5eedf55-dca |
5d4bb774-74a |
03f03042-1f7 |
Query 2:
index=<< index_name>> "Exception" | where server_ID= "server_ID from Query1 table"
Thank You
There's a pretty good example of that in the Dashboards and Visualizations manual at https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/ContextualDrilldown#Manage_and_respond_to_tok...
The concept is the first query has a <drilldown> element that sets a token value to the clicked cell. The second query references that token. The second query won't run until the token is assigned a value (when the user clicks on the table).
<query>index=<<index_name>> sourcetype=webserver | dedup server_ID | table server_ID</query>
<drilldown>
<set token="server_ID">$row.server_ID$</set>
</drilldown>
index=<< index_name>> "Exception" | where server_ID= $server_ID$
HI @richgalloway I am facing with below error when i tried the above solution that you provided.
ERROR: Node drilldown is not allowed here
Thank You
Why did you accept the answer if it doesn't work?
The dashboard code in the answer is not complete. The snippets provided need to be inserted into the proper places in your XML.
There's a pretty good example of that in the Dashboards and Visualizations manual at https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/ContextualDrilldown#Manage_and_respond_to_tok...
The concept is the first query has a <drilldown> element that sets a token value to the clicked cell. The second query references that token. The second query won't run until the token is assigned a value (when the user clicks on the table).
<query>index=<<index_name>> sourcetype=webserver | dedup server_ID | table server_ID</query>
<drilldown>
<set token="server_ID">$row.server_ID$</set>
</drilldown>
index=<< index_name>> "Exception" | where server_ID= $server_ID$
This link should get you started.
https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/ContextualDrilldown