I am trying to define a drilldown within a splunk form. However, when i click the row, it passes the variable $row.rid$ instead of the value.
Can someone where help what i am doing wrong?
Here is the code
<panel>
<table>
<title>Error Details</title>
<search>
<query>host="vmh001d009" index="coreservices" | transaction rid | search (level=ERROR OR level=FATAL) | rex field=url "http://(?<Service>[^/]+/[^/]+)" | eval Time=strftime(_time, "%H:%M %P %Z") | table Time, Service, funcname, user | rename funcname as Function, user as User</query>
<earliest>$timeSelection.earliest$</earliest>
<latest>$timeSelection.latest$</latest>
</search>
<drilldown>
<link>/app/coreservicesmonitoring/ptpe__debug?form.rid=$row.rid$</link>
</drilldown>
<option name="wrap">false</option>
<option name="rowNumbers">true</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<option name="drilldown">row</option>
</table>
</panel>
Here is what it resolves too; (note form.rid=%24row.rid%24 )
hi sanchitguptaiitd,
For this to work, there will have to be rid
a field that appears in the final table and you have displayed among the fields you want to display with the control table, I see no rid
.
for the syntax of the drilldown tag, everything is correct and should work.
try as I say, and let me know.
Here the sample code I used recently and it retrieves the exact value.
<panel>
<table id="master">
<title>Tickets for $host$, $status$, generated by Error_alert, triggered</title>
<search>
<query>index=ticket report="ticket1" $host$ $TicketNumber$ $status$ $comment$ |dedup TicketNumber
|table TicketNumber Alerttime status Comments Raw
</query>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<drilldown>
<!-- Use set to specify the new token to be created.
Use any token from the page or from the click event to produce the value needed. -->
<link>/app/CPU/tickets_list2?form.TicketNumber=$row.TicketNumber$</link>
</drilldown>
<option name="count">10</option>
</table>
</panel>
please forgive My english
hi sanchitguptaiitd,
For this to work, there will have to be rid
a field that appears in the final table and you have displayed among the fields you want to display with the control table, I see no rid
.
for the syntax of the drilldown tag, everything is correct and should work.
try as I say, and let me know.
Here the sample code I used recently and it retrieves the exact value.
<panel>
<table id="master">
<title>Tickets for $host$, $status$, generated by Error_alert, triggered</title>
<search>
<query>index=ticket report="ticket1" $host$ $TicketNumber$ $status$ $comment$ |dedup TicketNumber
|table TicketNumber Alerttime status Comments Raw
</query>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<drilldown>
<!-- Use set to specify the new token to be created.
Use any token from the page or from the click event to produce the value needed. -->
<link>/app/CPU/tickets_list2?form.TicketNumber=$row.TicketNumber$</link>
</drilldown>
<option name="count">10</option>
</table>
</panel>
please forgive My english
thanks, that worked! i assumed i could use any fields in underlying event, guess only those shown up in table can be passed.
Thanks again for your help
thanks, If it works; must then accepted