I have two “parallel” multivalue fields. One has friendly names and the other has the actual URL. In the example below, given the friendly name (cnn), it finds the corresponding URL:
| makeresults
| fields - _time
| eval friendly_names="google,facebook,cnn", urls="http://google.com,http://facebook.com,http://cnn.com"
| makemv friendly_names delim=","
| makemv urls delim=","
| eval url=mvindex(urls, mvfind(friendly_names,"cnn"))
| table url
This works exactly as I expect it to. When I try to use it in a dashboard event handler, it doesn’t work.
Anyone have any thoughts on what I might be doing wrong or an alternative way to do this? My desire is to generate some custom ugly URLs behind the scenes, but to present the user with friendly names on the dashboard.
<dashboard>
<row>
<panel>
<table>
<search>
<query>| makeresults
| fields - _time
| eval friendly_names="google,facebook,cnn", urls="http://google.com,http://facebook.com,http://cnn.com"
| makemv friendly_names delim=","
| makemv urls delim=","
| table friendly_names</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
**<condition field="friendly_names">
<eval token="url">mvindex(urls,mvfind(friendly_names,"$click.value2$"))</eval>
<link target="_blank">
<![CDATA[$url|n$]]>
</link>
</condition>**
</drilldown>
</table>
</panel>
</row>
</dashboard>
... View more