Splunk Search

How to change the search based on a clicked table value?

canar40
Engager

Newbie here so please bear with me 🙂
I created a table using stats count with 3 columns.
alt text

What I also did is to dynamically change the search to search on what I clicked. Afterwards, I use timechart count to display the results based on the opposite, e.g. if I click on a 10653_10_99, the time chart would be by "Bag verloren geraakt". The code:

index=wincc Type=2 Text1="Backbone"  State=3 |
rename Text5 as CI |  rename Text6 as Omschrijving |
search $columnName2$ = "$columnPicker2$" |
eval sortByTheOpposite = case("$columnName2$"=="Omschrijving",CI,"$columnName2$"=="CI", Omschrijving) |
timechart count by sortByTheOpposite useother=f limit=10

This works if I click on one of the first two columns. Now I want to dynamically change my search/time chart if I click on a value in the third column. This would require a string of type "search CI = "XX" AND Omschrijving = "YY" "
For this, I was planning to use click.name and row.Omschrijving and get the XX and YY values, however I cannot incorporate in the case the brackets. Any ideas of a work around? Thank you very much in advance!

0 Karma
1 Solution

canar40
Engager

For those interested, we fixed it this way:

<drilldown>
    <condition field="CI">
    <set token="columnName1">$click.name2$</set>
    <set token="valueName1">$click.value2$</set>
    </condition>
</drilldown>

Then you create a panel depending on a certain token:

<panel depends="valueName1">
</panel>

View solution in original post

canar40
Engager

For those interested, we fixed it this way:

<drilldown>
    <condition field="CI">
    <set token="columnName1">$click.name2$</set>
    <set token="valueName1">$click.value2$</set>
    </condition>
</drilldown>

Then you create a panel depending on a certain token:

<panel depends="valueName1">
</panel>
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...