Yes I understand this, I am new to Splunk so can you help me with how to set these tokens ... View more

1st search is a saved search and the 2nd one is normal search. ... View more

I already have 2 searches, but only one time picker dropdown panel. I want to trigger search 1 when the time range is selected as Last 7 Days, and search 2 when other time range is selected. I am new to Splunk so i am having difficulty understanding how should I proceed. Should I trigger the searches using tokens or something like that ? ... View more

I will test this once i return to work. Thanks for the prompt response. Very much appreciated ... View more

there is nothing else in the code apart from the changed query  for the second table i used only this part | makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val  and removed the last pipe. this is the only difference. But as per my understanding the code should still work fine. but the table remains hidden nonetheless. i created a sample code on my local splunk and copied your code as is and it seemed to work just fine but when transferring it to the main code its not working   ... View more

Table 1 <table id="Table_1"> <title>Table 1</title> <search id="Table_1"> <query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <condition match="match($row.val$, &quot;Fail&quot;)"> <set token="tkn_value">$row.val$</set> </condition> <condition> <unset token="tkn_value" /> </condition> </drilldown> <format type="color" field="Log"> <colorPalette type="list">[#FFFFFF,#DC4E41]</colorPalette> <scale type="threshold">1</scale> </format> </table> Table 2 <table id="Table_2" depends="$tkn_value$"> <title>Table 2</title> <search id="base_search_35_1"> <query> | makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val | where val="$tkn_value$" </query> </search> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> ... View more

i added this portion to my simple xml file in the first table <drilldown> <condition match="match($row.val$, &quot;Fail&quot;)"> <set token="tkn_value">$row.val$</set> </condition> <condition> <unset token="tkn_value" /> </condition> </drilldown>   and then  <table depends="$tkn_value$">  the above portion in the second table. but the second table always remains hidden for some reason no matter what the value is.  Note:- i changed the row.val as per my table requirement still its the same result.  ... View more

I am using Regex in my queries that are effecting the results in this table. but I was advised not to put the query here as it has some proprietary data, so i edited the question but I forgot to take to the regex tag.  Sorry missing that out. ... View more

This works fine. Thanks for the help.  Cheers... ... View more

This solution for some reason is not working for my dashboard panel. ... View more

This worked perfectly. Thanks a ton . ... View more

i am new to Splunk. Sorry in advance if i miss something. But in the second line of this query it seems that you are using the search result values. Since the search result values in the table are dynamic, wont this mean that every time we would have to pass section manually. or is there something else that i am missing. ... View more

thanks for the help. it worked out like a charm   ... View more

Thanks for the reply. i will test this out and let you know if this works for me. Thanks a ton. ... View more

 you can use something like this if you want to make changes to a particular column #tableWithDrilldown td:nth-child(16) { color: #1717E6 !important; font-weight: bold !important; text-decoration: underline !important; text-decoration-color: blue !important; }   ... View more

Thanks for the help. Worked absolutely perfectly. ... View more