Is there a way to use a renamed field as part of the $row.fieldname$
variable?
Take the following single panel dashboard:
<dashboard>
<label>Temp</label>
<row>
<table>
<searchString>index=temp | stats count by application_id application_name environment log_type log_level | sort -count</searchString>
<earliestTime>-24h@h</earliestTime>
<drilldown>
<link>/app/search/temp2?form.app_id=$row.application_id$</link>
</drilldown>
</table>
</row>
</dashboard>
Which links to a similar single panel dashboard:
<form>
<label>Temp2</label>
<fieldset autoRun="true">
<input type="text" token="app_id">
<label>Enter an Application ID:</label>
<default>*</default>
</input>
</fieldset>
<row>
<table>
<searchString>index=temp application_id=$app_id$ | stats count by application_id application_name environment log_type log_level | sort -count</searchString>
<earliestTime>-24h@h</earliestTime>
</table>
</row>
</form>
However, if I change the first dashboard's search to include | rename application_id AS "Application ID"
so the dashboard table has better visual appeal, I cannot use $row.application_id$
; the value to pass to the second dashboard has changed to "Application ID" and $row."Application ID"$
does not work, either. Is there a way to have the table for the first dashboard use renamed fields but still pass the row's application_id with $row.fieldname$
or similar?
Using Simple XML and Splunk 6.0.1
Instead of using $row."Application ID"$ , directly use $row.Application ID$. This works fine
Instead of using $row."Application ID"$ , directly use $row.Application ID$. This works fine