Splunk Search

Splunk table drill down - access different field value from clicked field value

designrahman
New Member

I have query that returns two or more events based on two input selects

input select 1: my_run_1_tag_1 (reference)
input select 2: my_run_2_tag_2 (comparables)

Based on this two keys and additional field selection through user input I get two or more events. I do additional filtering to create respective columns for a table

     field1_vio::tag_1      field1_vio::tag_2  field2_count::tag_1  field2_count::tag_2 

——————————————————————————————————————————————————————————————————————————
data_a | alpha_1 beta_1 alpha_2 beta_2
data_b | gamma_1 theta_1 alpha_3 beta_3
value_a | 500 200 900 10

The values 500, 200, 900 and 10 correspond to different files on different servers which I can access by creating a URL like https://myserverN.com/view.php?file=//rpt/filename

Problem is how do I get the field_3_path (a different field of the same row) of tag_1 from a drop down/click of the number 500 (field1_vio::tag_1).

      <eval token="path_prefix">"row." + "field1_Vio::" + $run$</eval>
      <set token="path">$path_prefix$</set>

OR

      <eval token="path_prefix">"field1_Vio::" + $run$</eval>
      <set token="path">row.$path_prefix$</set>

Here is more details of the context. I am trying to construct the variable $path$ from the row/field information

    <drilldown>
      <condition field="*">
      <eval token="branch">mvindex(split($click.name2$, "::"),0)</eval> (expected return field1_vio)
      <eval token=“run”>mvindex(split($click.name2$, "::"),1)</eval>  (expected return date_1)
      <eval token="path">"row." + “field3_path::” + $run$</eval> (expected return field3_path::date_1 - however I’m unable to get this)
      <link target="_blank">https://myserver.com/view.php?file=$path$/filename.rpt</link> 
     </condition>
    </drilldown>
0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...