Hola Splunkers,
I want to consolidate two dynamic drilldowns in a table. Each drilldown is passing the same token $token$, and my table should display the relevant events (all the events come from the same source)
I'm trying to keep things simple, and I'm very close to make it work.
My 1st problem is: I coudn't find a simple way to verify is the $token$ has a default value or has a "legal" value. (isnull ie)
So, I've decided to use the same variable for both graphs....$type_tok$, which leads to my 2nd problem. I cannot execute a search with a condition in a variable.
From the graph#1, the values in the token are: "SUCCESS", "ERROR", "UNDEF". (A value in the field Response)
From the graph #2, the values are: A01, D03, F05 (always number in the 2nd position) (A value in the field Result)
So I'm trying to distinguish between the two sources, checking if the 2nd character in the token is a number, so in my table, Im trying something like:
...| eval condition=if(isint(substr($type_tok$,2,1)), "Response=$type_tok$", "Result=$type_tok$")| search condition | table _time, Id, error, Type, EndTime
But of course, it doesn't work. The eval fails, and the search never works.
I tried a simple search with a variable with and without $, but I couldn't make it work.
... | eval test="Respons=SUCCESS" | search $test$
I know it is possible to trigger saved search, but I prefer not to do it.
Any advice?
... View more