Dashboards & Visualizations

Need your help to display a field value when mouse hover in any of the statistics table field value

rajaguru27902
New Member

Hi Team,

Need your help. We have a data as below. Now we have a field have message. From that EFFDATE,MEMID and MID has been derived. Now customer wants a drilldown. In statistics table if he do a mouse over on any of the fields EFFDATE,MEMID and MID the entire value in "message" field should be listed. It is like a mouseover in Column chart, Attached below. Please help me the logic. CSS/Script/Tokens. Expecting your help on this.

| makeresults count=3
| eval  message="Message"+" "+"14"+" "+"DUPLICATE"+" "+"MID"+"Mid"+":"+"103557"+"'"+"memId"+":"+"98"+"'"+"Eff Date"+":"+"Wed Nov 06 00:00:00 CST 2019"
|rex field="message" "(.*)(?<MID>\d\d\d\d\d\d)(.*)"  
|rex field="message" "(.*)(?<MEMID>\d\d)(.*)"   
|rex field="message" (.*(?<EFFDATE>\D\D\D\s\D\D\D\s\d\d\s\d\d:\d\d:\d\d\s\D\D\D\s\d\d\d\d))
| fields - _time



  EFFDATE                             MEMID          MID           message
    Wed Nov 06 00:00:00 CST 2019           19           103557     Message 14 DUPLICATE MIDMid:103557'memId:98'Eff Date:Wed Nov 06 00:00:00 CST 2019
    Wed Nov 06 00:00:00 CST 2019           19           103557   Message 14 DUPLICATE MIDMid:103557'memId:98'Eff Date:Wed Nov 06][1]
Tags (1)
0 Karma

rajagurup
New Member

Please update on this query

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...