- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- splitting and sending the value from drill down to...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI ,
I am trying to send values from one panel to another dashboard using drill down , is it possible to split the value and then send....
I have field name
"host: Running" ,
"service: Running" ,
"URL: Running" in main dashboard, these are generated fields, when i click on any field it should trigger drill down
In my drilldown dashboard I have a dropdown and want only the "host" from main dashboard,
Drill Down Dropdown
| service: Running |
Expected Dropdown
| service |
Basically want to split the value in main dashboard
My drilldown
form.token=$click.name2$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this run anywhere example and can use in your drill down
<dashboard>
<label>DrillDown</label>
<row>
<panel>
<table>
<search>
<query>| makeresults|eval "host: Running" ="hostnames"
|eval "service: Running"="service name"</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<drilldown>
<eval token="tokenName">mvindex(split($click.name2$,":"),0)</eval>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
<h2>Token Value : $tokenName$</h2>
</html>
</panel>
</row>
</dashboard>
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this run anywhere example and can use in your drill down
<dashboard>
<label>DrillDown</label>
<row>
<panel>
<table>
<search>
<query>| makeresults|eval "host: Running" ="hostnames"
|eval "service: Running"="service name"</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<drilldown>
<eval token="tokenName">mvindex(split($click.name2$,":"),0)</eval>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
<h2>Token Value : $tokenName$</h2>
</html>
</panel>
</row>
</dashboard>
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for this approach....although I had to do drilldown to another dashboard...but the split logic used in drilldown was the need for me...thanks a lot
Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...
Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...
Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...
