Hi Splunk, I created a dashboard with various panels. Some of the panels are tables with drilldown searches allowing you to click on the value, and opening a new tab using the value clicked on ($...
See more...
Hi Splunk, I created a dashboard with various panels. Some of the panels are tables with drilldown searches allowing you to click on the value, and opening a new tab using the value clicked on ($row.user.value$) in the new search. However, for some reason the drilldown on one panel opens the search without populating the variable: $row.user.value$ All the other panels' drilldown searches work. Source code of panel: {
"type": "splunk.table",
"options": {
"count": 100,
"dataOverlayMode": "none",
"drilldown": "none",
"showRowNumbers": false,
"showInternalFields": false
},
"dataSources": {
"primary": "ds_aaaa"
},
"title": "Panel One (Last 30 Days)",
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"query": "index=\"winlog\" EventCode=4625 user=$row.user.value$",
"earliest": "auto",
"latest": "auto",
"type": "custom",
"newTab": true
}
}
],
"context": {},
"showProgressBar": false,
"showLastUpdated": false
} The SPL after clicking on the table value: index="winlog" EventCode=4625 user=$row.user.value$ Why does the $row.user.value$ not populate?