Dashboards & Visualizations

splunk dynamic drilldown shows variable instead of value

sanchitguptaiit
Explorer

I am trying to define a drilldown within a splunk form. However, when i click the row, it passes the variable $row.rid$ instead of the value.

Can someone where help what i am doing wrong?

Here is the code

 <panel>
      <table>
        <title>Error Details</title>
        <search>
          <query>host="vmh001d009" index="coreservices"  | transaction rid | search (level=ERROR OR level=FATAL)  | rex field=url "http://(?<Service>[^/]+/[^/]+)" | eval Time=strftime(_time, "%H:%M %P %Z") | table Time, Service, funcname, user | rename funcname as Function, user as User</query>
          &lt;earliest&gt;$timeSelection.earliest$&lt;/earliest&gt;
          &lt;latest&gt;$timeSelection.latest$&lt;/latest&gt;
        </search>
        <drilldown>
          &lt;link&gt;/app/coreservicesmonitoring/ptpe__debug?form.rid=$row.rid$&lt;/link&gt;
        </drilldown>
        <option name="wrap">false</option>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
        <option name="drilldown">row</option>
      </table>
    </panel>

Here is what it resolves too; (note form.rid=%24row.rid%24 )

https://prodsplunk/en-US/app/coreservicesmonitoring/ptpe__debug?form.rid=%24row.rid%24&form.time.ear...

0 Karma
1 Solution

gyslainlatsa
Motivator

hi sanchitguptaiitd,

For this to work, there will have to be rida field that appears in the final table and you have displayed among the fields you want to display with the control table, I see no rid.
for the syntax of the drilldown tag, everything is correct and should work.
try as I say, and let me know.

Here the sample code I used recently and it retrieves the exact value.

 <panel>
      <table id="master">
        <title>Tickets for $host$, $status$, generated by Error_alert, triggered</title>
        <search>
          <query>index=ticket report="ticket1" $host$ $TicketNumber$ $status$ $comment$ |dedup TicketNumber
             |table TicketNumber Alerttime status Comments Raw 
          </query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>

        <drilldown>
          <!-- Use set to specify the new token to be created.
            Use any token from the page or from the click event to produce the value needed. -->  
          <link>/app/CPU/tickets_list2?form.TicketNumber=$row.TicketNumber$</link>
        </drilldown>
        <option name="count">10</option>
      </table>
    </panel>

please forgive My english

View solution in original post

gyslainlatsa
Motivator

hi sanchitguptaiitd,

For this to work, there will have to be rida field that appears in the final table and you have displayed among the fields you want to display with the control table, I see no rid.
for the syntax of the drilldown tag, everything is correct and should work.
try as I say, and let me know.

Here the sample code I used recently and it retrieves the exact value.

 <panel>
      <table id="master">
        <title>Tickets for $host$, $status$, generated by Error_alert, triggered</title>
        <search>
          <query>index=ticket report="ticket1" $host$ $TicketNumber$ $status$ $comment$ |dedup TicketNumber
             |table TicketNumber Alerttime status Comments Raw 
          </query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>

        <drilldown>
          <!-- Use set to specify the new token to be created.
            Use any token from the page or from the click event to produce the value needed. -->  
          <link>/app/CPU/tickets_list2?form.TicketNumber=$row.TicketNumber$</link>
        </drilldown>
        <option name="count">10</option>
      </table>
    </panel>

please forgive My english

sanchitguptaiit
Explorer

thanks, that worked! i assumed i could use any fields in underlying event, guess only those shown up in table can be passed.

Thanks again for your help

0 Karma

gyslainlatsa
Motivator

thanks, If it works; must then accepted

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...