Splunk Search

splunk event identifier

dordavid
Explorer

hey there 🙂 

i'm trying to make a table with the next fields: name, last name and message:

index a | table name last name message

i want to add the identifier of event to my table - (the identifier which splunk generate (c_id?) )

how can i done that?

 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dordavid,

what do you mean with: "the identifier which splunk generate (c_id?)"?

what do you want to do with it?

Ciao.

Giuseppe

0 Karma

dordavid
Explorer

hey @gcusello 
i want to create one big table:

index=a | table name last name message

i want to drill down to another hidden table:

when i will click on the message value -> an hidden panel will be seen with a table that show the only the chosen raw.

i want to drill down with a query like:

 index=a  identifier=???? | table name last name message

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dordavid,

there isn't an absolute identifier because the events depend on the search.

So you could pass in drilldown all the fields in your table: name last_name message.

something like this:

        <drilldown>
          <link target="_blank">/app/your_app/drilldown_dashboard?name=$row.name$&amp;last_name=$row.last_name$&amp;message=$row.message$</link>
        </drilldown>

Ciao.

Giuseppe

0 Karma

dordavid
Explorer

@gcusello 

 usually my message field is very long - sometimes 150 rows length, so i used substr function on my message field, so actually my my message seems like:
eval message=substr(message, 1, 1000) - (only first 1000 chars)

 

i want to click on the message value  and display an hidden panel will show a table with the chosen raw.  

i try to do:

message=$row.message$

but sometimes i got errors like: "unbalanced quotes" - [because of the substr].

so i think to use _cd of event to do the search

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dordavid,

as I feared, there are some quotes in your message, so you can't use it.

See if the other two fields are enough, otherwise you have to take another one in order to uniquely identify the event on which to drill down, a field that you can then also not display (using the <fields> option) at the end.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...