Splunk Search

How to change the search based on a clicked table value?

canar40
Engager

Newbie here so please bear with me 🙂
I created a table using stats count with 3 columns.
alt text

What I also did is to dynamically change the search to search on what I clicked. Afterwards, I use timechart count to display the results based on the opposite, e.g. if I click on a 10653_10_99, the time chart would be by "Bag verloren geraakt". The code:

index=wincc Type=2 Text1="Backbone"  State=3 |
rename Text5 as CI |  rename Text6 as Omschrijving |
search $columnName2$ = "$columnPicker2$" |
eval sortByTheOpposite = case("$columnName2$"=="Omschrijving",CI,"$columnName2$"=="CI", Omschrijving) |
timechart count by sortByTheOpposite useother=f limit=10

This works if I click on one of the first two columns. Now I want to dynamically change my search/time chart if I click on a value in the third column. This would require a string of type "search CI = "XX" AND Omschrijving = "YY" "
For this, I was planning to use click.name and row.Omschrijving and get the XX and YY values, however I cannot incorporate in the case the brackets. Any ideas of a work around? Thank you very much in advance!

0 Karma
1 Solution

canar40
Engager

For those interested, we fixed it this way:

<drilldown>
    <condition field="CI">
    <set token="columnName1">$click.name2$</set>
    <set token="valueName1">$click.value2$</set>
    </condition>
</drilldown>

Then you create a panel depending on a certain token:

<panel depends="valueName1">
</panel>

View solution in original post

canar40
Engager

For those interested, we fixed it this way:

<drilldown>
    <condition field="CI">
    <set token="columnName1">$click.name2$</set>
    <set token="valueName1">$click.value2$</set>
    </condition>
</drilldown>

Then you create a panel depending on a certain token:

<panel depends="valueName1">
</panel>
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...