Splunk Search

Splunk table drill down - access different field value from clicked field value

designrahman
New Member

I have query that returns two or more events based on two input selects

input select 1: my_run_1_tag_1 (reference)
input select 2: my_run_2_tag_2 (comparables)

Based on this two keys and additional field selection through user input I get two or more events. I do additional filtering to create respective columns for a table

     field1_vio::tag_1      field1_vio::tag_2  field2_count::tag_1  field2_count::tag_2 

——————————————————————————————————————————————————————————————————————————
data_a | alpha_1 beta_1 alpha_2 beta_2
data_b | gamma_1 theta_1 alpha_3 beta_3
value_a | 500 200 900 10

The values 500, 200, 900 and 10 correspond to different files on different servers which I can access by creating a URL like https://myserverN.com/view.php?file=//rpt/filename

Problem is how do I get the field_3_path (a different field of the same row) of tag_1 from a drop down/click of the number 500 (field1_vio::tag_1).

      <eval token="path_prefix">"row." + "field1_Vio::" + $run$</eval>
      <set token="path">$path_prefix$</set>

OR

      <eval token="path_prefix">"field1_Vio::" + $run$</eval>
      <set token="path">row.$path_prefix$</set>

Here is more details of the context. I am trying to construct the variable $path$ from the row/field information

    <drilldown>
      <condition field="*">
      <eval token="branch">mvindex(split($click.name2$, "::"),0)</eval> (expected return field1_vio)
      <eval token=“run”>mvindex(split($click.name2$, "::"),1)</eval>  (expected return date_1)
      <eval token="path">"row." + “field3_path::” + $run$</eval> (expected return field3_path::date_1 - however I’m unable to get this)
      <link target="_blank">https://myserver.com/view.php?file=$path$/filename.rpt</link> 
     </condition>
    </drilldown>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Splunk is excited to announce the General Availability (GA) of Federated Search for ...

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

If you’ve spent any time in the Splunk Community Slack, you’ve likely seen our resident Splunk Trust ...

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also ...