Dashboards & Visualizations

How to pass more than 2 values when clicking on a row for drill down search?

asingla
Communicator

SimpleResultTable passes the value for the fist column as click.value when user clicks on a row. Is it possible to have access of all the column values (click.value2, click.value3...) when user clicks on a row for the drill down search?

2) Is it possible to hide a column (first one) in the SimpleResultTable and then pass this hidden column value when user clicks on a row?

wwhitener
Communicator

Splunk lets you record 4 values from a click.

click.name = click.value
click.name2 = click.value2

I'd suggest using a simple header to make sure that those cover whatever values you want--especially if you end up with a split-by clause in your query. Since you can nest the tables, you might be able to do more, but I haven't tried it. Otherwise, give the sideview stuff a try and let us know how it works out.

0 Karma

sideview
SplunkTrust
SplunkTrust

click.name and click.value are the column header, and the cell value, respectively, of the first column. Sorry for extra commas but it's a mouthful. As for click.name2 and click.value2 -- in "row" drilldown where the entire row lights up yellow onmouseover, those will always be identical to the first pair. In "cell" aka "all" configuration, those will be the column and cell value respectively of the cell that the user happened to click on. Unfortunately outside of occasional "split by" use cases, you'll usually be using "row" drilldown, and as such you really only have the first cell.

0 Karma

sideview
SplunkTrust
SplunkTrust

The first is not possible with just the core SimpleResultsTable. However if you use Sideview Utils ( http://splunk-base.splunk.com/apps/22279/sideview-utils ) in your app, and you follow it's instructions and embedded documentation, its code patches the SimpleResultsTable module to provide additional keys.

Specifically, you get $click.fields.someFieldName$ $click.fields.someOtherFieldName$, etc... for all the cells in the row, and you also get $click.cell0.value$, $click.cell7.value$, in case that's ever useful...

As far as your second question, I have implemented this in several apps, but only by adding some custom code to the app. I'm afraid the approach is a little too involved to lay out here.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...