Splunk Search

Splunk table drill down - access different field value from clicked field value

designrahman
New Member

I have query that returns two or more events based on two input selects

input select 1: my_run_1_tag_1 (reference)
input select 2: my_run_2_tag_2 (comparables)

Based on this two keys and additional field selection through user input I get two or more events. I do additional filtering to create respective columns for a table

     field1_vio::tag_1      field1_vio::tag_2  field2_count::tag_1  field2_count::tag_2 

——————————————————————————————————————————————————————————————————————————
data_a | alpha_1 beta_1 alpha_2 beta_2
data_b | gamma_1 theta_1 alpha_3 beta_3
value_a | 500 200 900 10

The values 500, 200, 900 and 10 correspond to different files on different servers which I can access by creating a URL like https://myserverN.com/view.php?file=//rpt/filename

Problem is how do I get the field_3_path (a different field of the same row) of tag_1 from a drop down/click of the number 500 (field1_vio::tag_1).

      <eval token="path_prefix">"row." + "field1_Vio::" + $run$</eval>
      <set token="path">$path_prefix$</set>

OR

      <eval token="path_prefix">"field1_Vio::" + $run$</eval>
      <set token="path">row.$path_prefix$</set>

Here is more details of the context. I am trying to construct the variable $path$ from the row/field information

    <drilldown>
      <condition field="*">
      <eval token="branch">mvindex(split($click.name2$, "::"),0)</eval> (expected return field1_vio)
      <eval token=“run”>mvindex(split($click.name2$, "::"),1)</eval>  (expected return date_1)
      <eval token="path">"row." + “field3_path::” + $run$</eval> (expected return field3_path::date_1 - however I’m unable to get this)
      <link target="_blank">https://myserver.com/view.php?file=$path$/filename.rpt</link> 
     </condition>
    </drilldown>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...