Dashboards & Visualizations

How to combine two tables and make the drilldown work as normal?

bkumarm
Contributor

I have two tables that are generated out of queries as below:

Search1:

eventtype="Myown" source="*File1*" | dedup ID| eval A1=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg | eval S1=if(A1="Pass", "Pass", "Fail") | transaction ID keepevicted=t | table _time, ID,  Error, S1,  A1

Search2:

eventtype="Myown" source="*File2*"  |  dedup ID | eval S2=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg | transaction ID keepevicted=t | table _time, ID,  Error,  S2

These two searches generate tables and behave as expected.
Next I am combining them into one using append as below:

eventtype="Myown" source="*File1*" | dedup ID| eval A1=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg | eval S1=if(A1="Pass", "Pass", "Fail") |  append [search eventtype="Myown" source="*File2*"  |  dedup ID | eval S2=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg] | transaction ID keepevicted=t | table _time, ID,  Error,  S2

The table comes up correctly and the values are shown properly.
When I click on any cell, that provides me drill down to the log entry properly.
However, at this point when I click Actions and show source, it is throwing an error and does not display the source.

any suggestions?

0 Karma

sundareshr
Legend

What error are you getting? You cannot see source when you use transaction. Remove the transaction command. You should still get the desired results. But, again, I think you will get an error when you click on the row generated by the sub-search.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...