Splunk Search

Splunk table drill down - access different field value from clicked field value

designrahman
New Member

I have query that returns two or more events based on two input selects

input select 1: my_run_1_tag_1 (reference)
input select 2: my_run_2_tag_2 (comparables)

Based on this two keys and additional field selection through user input I get two or more events. I do additional filtering to create respective columns for a table

     field1_vio::tag_1      field1_vio::tag_2  field2_count::tag_1  field2_count::tag_2 

——————————————————————————————————————————————————————————————————————————
data_a | alpha_1 beta_1 alpha_2 beta_2
data_b | gamma_1 theta_1 alpha_3 beta_3
value_a | 500 200 900 10

The values 500, 200, 900 and 10 correspond to different files on different servers which I can access by creating a URL like https://myserverN.com/view.php?file=//rpt/filename

Problem is how do I get the field_3_path (a different field of the same row) of tag_1 from a drop down/click of the number 500 (field1_vio::tag_1).

      <eval token="path_prefix">"row." + "field1_Vio::" + $run$</eval>
      <set token="path">$path_prefix$</set>

OR

      <eval token="path_prefix">"field1_Vio::" + $run$</eval>
      <set token="path">row.$path_prefix$</set>

Here is more details of the context. I am trying to construct the variable $path$ from the row/field information

    <drilldown>
      <condition field="*">
      <eval token="branch">mvindex(split($click.name2$, "::"),0)</eval> (expected return field1_vio)
      <eval token=“run”>mvindex(split($click.name2$, "::"),1)</eval>  (expected return date_1)
      <eval token="path">"row." + “field3_path::” + $run$</eval> (expected return field3_path::date_1 - however I’m unable to get this)
      <link target="_blank">https://myserver.com/view.php?file=$path$/filename.rpt</link> 
     </condition>
    </drilldown>
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...