Dashboards & Visualizations

Use Renamed Fields in Dashboard Drilldown to Form

Yorokobi
SplunkTrust
SplunkTrust

Is there a way to use a renamed field as part of the $row.fieldname$ variable?

Take the following single panel dashboard:

<dashboard>
    <label>Temp</label>
    <row>
      <table>
        <searchString>index=temp | stats count by application_id application_name environment log_type log_level | sort -count</searchString>
        <earliestTime>-24h@h</earliestTime>
        <drilldown>
          <link>/app/search/temp2?form.app_id=$row.application_id$</link>
        </drilldown>
      </table>
    </row>
  </dashboard>

Which links to a similar single panel dashboard:

<form>
    <label>Temp2</label>
     <fieldset autoRun="true">
   <input type="text" token="app_id">
  <label>Enter an Application ID:</label>
  <default>*</default>
  </input>
  </fieldset>
    <row>
      <table>
        <searchString>index=temp application_id=$app_id$ | stats count by application_id application_name environment log_type log_level | sort -count</searchString>
        <earliestTime>-24h@h</earliestTime>
      </table>
    </row>
  </form>

However, if I change the first dashboard's search to include | rename application_id AS "Application ID" so the dashboard table has better visual appeal, I cannot use $row.application_id$; the value to pass to the second dashboard has changed to "Application ID" and $row."Application ID"$ does not work, either. Is there a way to have the table for the first dashboard use renamed fields but still pass the row's application_id with $row.fieldname$ or similar?

Using Simple XML and Splunk 6.0.1

Tags (2)
1 Solution

somesoni2
Revered Legend

Instead of using $row."Application ID"$ , directly use $row.Application ID$. This works fine

View solution in original post

somesoni2
Revered Legend

Instead of using $row."Application ID"$ , directly use $row.Application ID$. This works fine

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...