Splunk Search

How to change the search based on a clicked table value?

canar40
Engager

Newbie here so please bear with me 🙂
I created a table using stats count with 3 columns.
alt text

What I also did is to dynamically change the search to search on what I clicked. Afterwards, I use timechart count to display the results based on the opposite, e.g. if I click on a 10653_10_99, the time chart would be by "Bag verloren geraakt". The code:

index=wincc Type=2 Text1="Backbone"  State=3 |
rename Text5 as CI |  rename Text6 as Omschrijving |
search $columnName2$ = "$columnPicker2$" |
eval sortByTheOpposite = case("$columnName2$"=="Omschrijving",CI,"$columnName2$"=="CI", Omschrijving) |
timechart count by sortByTheOpposite useother=f limit=10

This works if I click on one of the first two columns. Now I want to dynamically change my search/time chart if I click on a value in the third column. This would require a string of type "search CI = "XX" AND Omschrijving = "YY" "
For this, I was planning to use click.name and row.Omschrijving and get the XX and YY values, however I cannot incorporate in the case the brackets. Any ideas of a work around? Thank you very much in advance!

0 Karma
1 Solution

canar40
Engager

For those interested, we fixed it this way:

<drilldown>
    <condition field="CI">
    <set token="columnName1">$click.name2$</set>
    <set token="valueName1">$click.value2$</set>
    </condition>
</drilldown>

Then you create a panel depending on a certain token:

<panel depends="valueName1">
</panel>

View solution in original post

canar40
Engager

For those interested, we fixed it this way:

<drilldown>
    <condition field="CI">
    <set token="columnName1">$click.name2$</set>
    <set token="valueName1">$click.value2$</set>
    </condition>
</drilldown>

Then you create a panel depending on a certain token:

<panel depends="valueName1">
</panel>
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...