Drill Down Help for Dashboard with \ in variable

[ghostdog920]

Good morning,

I am trying to build a drill down off one dashboard panel to build a search in the second. The issue i am running into is am passing a value of pf\first.last but in the new search, it needs to pass as pf\first.last (notice the extra escape \ character). Does anyone know how i might do this? My current search is: (where $user.user$) is a drill down set value option from a corresponding panel.

eventtype="pan_url" dest_zone="L3-Untrust" src_user=$user.user$ (app=adobe-connect OR app=brighttalk OR app=citrix OR app=citrix-jedi OR app=clearspace OR app=globalmeet-base OR app=gotomeeting OR app=gotowebinar-base OR app=hp-virtual-rooms OR app=jabber OR app=join-me OR app=live-meeting OR app=meetup OR app=skype OR app=tigertext OR app=webex OR app=zendesk OR app=zoom OR app=teamviewer-base)| stats count by app | sort - count

Any help is greatly apprecated.

[ghostdog920]

Got It! Thank you. Worked like a champ!

[ghostdog920 · Accepted solution]

Thank you for that. I am trying to use the edit drill down so not sure how I would implement that in the first panel to feed to the second. Here is a screenshot in case it proves helpful.

[elliotproebstel]

In the first panel, you are taking the value from one field, adding a second slash to the value in that field, and putting it into the token user.name. Let's say the field in the first panel is called name_field. Then in the dropdown you show above, you'd change "Set" to "Eval", leave "user.user" in the first text entry box, and put this into the second:

mvjoin(split($row.name_field$, "\\"), "\\\\")

That should take the value from name_field in the first panel, add a second slash, and put it all into the user.user token.

[elliotproebstel]

How about using an eval to add a second slash before passing it to the other dashboard? Here's a sample:

| makeresults 
| eval a="pf\something" 
| eval b=mvjoin(split(a, "\\"), "\\\\")

This guide documents how to use <eval> elements to modify values being passed in a drilldown:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting