Splunk Search
Highlighted

Splunk table drill down - access different field value from clicked field value

New Member

I have query that returns two or more events based on two input selects

input select 1: myrun1tag1 (reference)
input select 2: myrun2tag2 (comparables)

Based on this two keys and additional field selection through user input I get two or more events. I do additional filtering to create respective columns for a table

     field1_vio::tag_1      field1_vio::tag_2  field2_count::tag_1  field2_count::tag_2 

——————————————————————————————————————————————————————————————————————————
dataa | alpha1 beta1 alpha2 beta2
data
b | gamma1 theta1 alpha3 beta3
value_a | 500 200 900 10

The values 500, 200, 900 and 10 correspond to different files on different servers which I can access by creating a URL like https://myserverN.com/view.php?file=//rpt/filename

Problem is how do I get the field3path (a different field of the same row) of tag1 from a drop down/click of the number 500 (field1vio::tag_1).

      <eval token="path_prefix">"row." + "field1_Vio::" + $run$</eval>
      <set token="path">$path_prefix$</set>

OR

      <eval token="path_prefix">"field1_Vio::" + $run$</eval>
      <set token="path">row.$path_prefix$</set>

Here is more details of the context. I am trying to construct the variable $path$ from the row/field information

    <drilldown>
      <condition field="*">
      <eval token="branch">mvindex(split($click.name2$, "::"),0)</eval> (expected return field1_vio)
      <eval token=“run”>mvindex(split($click.name2$, "::"),1)</eval>  (expected return date_1)
      <eval token="path">"row." + “field3_path::” + $run$</eval> (expected return field3_path::date_1 - however I’m unable to get this)
      <link target="_blank">https://myserver.com/view.php?file=$path$/filename.rpt</link> 
     </condition>
    </drilldown>
0 Karma