Splunk Search

To change the column value in query using eval or regex

rj1408
Path Finder

Hi ,

rj1408_0-1607613172326.png

So if I click at Success/Failure I'm able to get all the transaction IDs which have status Success/Failure, But if i chose Total_Transaction I'm unable to change it to "*" using eval. 

Below is the query, Im using drilldown for column name and column value, since its taking column value as Total_Transaction its unable to trace to *. Need help with the eval if query.

Query-
index="int_gcg_apac_pcf_application_dm_169688" cf_org_name="CM-AP-SIT2" cf_space_name="166190_GCESMS" ESMS_MainMethod=doLostStolen OR ESMS_MainMethod=saveReqest OR ESMS_MainMethod=updateTempCreditLimit |stats dc(ESMS_TransactionID), sum(ESMS_ResponseTime), count(ESMS_StatusSuccess), count(ESMS_StatusFailure) as count by ESMS_MainMethod | rename ESMS_MainMethod as MicroService dc(ESMS_TransactionID) as Total_Transaction sum(ESMS_ResponseTime) as Total_Time count(ESMS_StatusSuccess) as Sucess count as Failure | eval "Success%"=((Success/Total_Transaction)*100) , "Failure%"=((Failure/Total_Transaction)*100), "Avg"=(Total_Time/Total_Transaction) | replace loadCardProfile1 with ESMS_CardProfile processCriteria with ESMS_GBCR saveReqest with ESMS_DB_Service doLostStolen with ESMS_LostStolen_Service doRetailConversion with ESMS_RetailConversion updateTempCreditLimit with ESMS_TempCreditLimit_Service


 

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
        <drilldown>
          <set token="form.MS_filter">$click.value$</set>
          <eval token="clicked_col">if($click.name2$=="Total_Transaction","*",$click.name2$)</eval>
        </drilldown>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

What have you tried? Can you share the dashboard XML?

0 Karma

rj1408
Path Finder

Hi ITWhisperer,

Have used this

rj1408_0-1607619524435.png


So here Im using drilldown to get this table from the above table:

 

 

rj1408_1-1607619717461.png



The problem is if  I click on the "Total_Transaction" I'm unable to change the value to "*", to show all the TransactionIDs.

Also can u suggest me how to hide rows alternatively whenever any of the two rows StausFailure/StatusSucces is completyly empty

My dashboard:  


 <row>
    <panel>
      <title>MicroServices</title>
      <table>
        <title>The Succes Error Percentage</title>
        <search>
          <query>index="int_gcg_apac_pcf_application_dm_169688" cf_org_name="CM-AP-SIT2" cf_space_name="166190_GCESMS" ESMS_MainMethod=doLostStolen OR ESMS_MainMethod=saveReqest OR ESMS_MainMethod=updateTempCreditLimit |stats dc(ESMS_TransactionID), sum(ESMS_ResponseTime), count(ESMS_StatusSuccess), count(ESMS_StatusFailure) as count by ESMS_MainMethod | rename ESMS_MainMethod as MicroService  dc(ESMS_TransactionID) as Total_Transaction sum(ESMS_ResponseTime) as Total_Time count(ESMS_StatusSuccess) as Sucess count as Failure | eval "Success%"=((Success/Total_Transaction)*100) , "Failure%"=((Failure/Total_Transaction)*100), "Avg"=(Total_Time/Total_Transaction) | replace loadCardProfile1 with ESMS_CardProfile processCriteria with ESMS_GBCR saveReqest with ESMS_DB_Service doLostStolen with ESMS_LostStolen_Service  doRetailConversion with ESMS_RetailConversion updateTempCreditLimit with ESMS_TempCreditLimit_Service</query>
          <earliest>$timepicker.earliest$</earliest>
          <latest>$timepicker.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="form.MS_filter">$click.value$</set>
          <set token="clicked_col">$click.name2$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>TransactionIDs</title>
      <table>
        <title>$MS_filter$</title>
        <search>
          <query>index="int_gcg_apac_pcf_application_dm_169688" cf_org_name="CM-AP-SIT2" cf_space_name="166190_GCESMS"  ESMS_MS=$form.MS_filter$  ESMS_MainMethod=doLostStolen OR ESMS_MainMethod= loadCardProfile1 OR ESMS_MainMethod=processCriteria OR ESMS_MainMethod=saveReqest OR ESMS_MainMethod=updateTempCreditLimit ESMS_StatusSuccess=$clicked_col$ OR ESMS_StatusFailure=$clicked_col$  | table   ESMS_TransactionID,ESMS_Country, ESMS_ResponseTime, ESMS_MS, ESMS_StatusFailure, ESMS_StatusSuccess</query>
          <earliest>$timepicker.earliest$</earliest>
          <latest>$timepicker.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="form.TransactionID_filter">$click.value$</set>
        </drilldown>
      </table>
    </panel>
  </row>



 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
        <drilldown>
          <set token="form.MS_filter">$click.value$</set>
          <eval token="clicked_col">if($click.name2$=="Total_Transaction","*",$click.name2$)</eval>
        </drilldown>

rj1408
Path Finder

@ITWhisperer Thankyou! 🙂

0 Karma

rj1408
Path Finder
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...