how to set token from a table

crazyeva · ‎01-21-2016

Hi
suppose search result:

col1  col2
1       2

then

<preview>
<set token="row1_col2">$result.col2$</set>
</preview>

will set value "2" for "$row1_col2$"

but if search result as:

    col1  col2
    1       2
    3       4

how could i get the value of "row2_col2" ?

crazyeva · ‎01-21-2016

thank you
still a lot to learn from 'Simple XML Reference'
but my issue is not about a drilldown search. it's just html display style. there will be no 'click' to set tokens
the result table will not appear.
values just shows in html as:
hello, a demo~
value_of_row1_col1
value_of_row1_col2
value_of_row2_col1
value_of_row2_col2

rohansecadvbot · ‎12-18-2017

Hi, Did you ever figure this out?

carlosdesousa91 · ‎04-11-2019

Hi, did you found a solution?

crazyeva · ‎12-18-2017

Hi, seems not yet. I almost forget about this.

renjith_nair · ‎01-21-2016

In a table drill down, by default you have row.fieldname as a token

In your case , you when you click on the second row, you have row2_col2 value in row.col2

click.name  Name of the leftmost field that is displayed in the table. This is always _time, if present.
click.value Value of the left-most column in the clicked row.
click.name2 Name of the clicked column.
click.value2    Value of the clicked column.
row.<fieldname> All field values for the clicked table row, including those fields that are not displayed.
earliest/latest Time range of the clicked table row, or if not applicable, the time range of the search.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_event...

Happy Splunking!

chimell · ‎01-21-2016

hi can you send your xml code please

crazyeva · ‎01-21-2016

<form>
  <panel>
    <search ref="a savedsearch">
      <preview>
        <set token="value">$result.count$</set>
      </preview>
    </search>
    <html>
      <h1>$value$</h1>
    </html>
  </panel>
</form>

Xml code a bit complicate and structure like above

how to set token from a table

Introducing the 2024 SplunkTrust!

Introducing the 2024 Splunk MVPs!

Splunk Custom Visualizations App End of Life