Hey!
I am building a dashboard and this problem is being a headache. I really need to find a way to drilldown values from hidden fields and/or panels, but not sure how to do so.. Can anyone help me, please?
Thanks in advance!
Based on your comments, what you might be looking for is something like this:
<table>
<search>
<query>data=A | table info date</query>
</search>
<drilldown>
<eval token="drilldown_token">strftime(strptime('row.date', "%F"), "%d.%m.%Y")</eval>
</drilldown>
</table>
...
<table depends="$drilldown_token$">
<search>
<query>data=B | search other_date="$drilldown_token$"</query>
</search>
</table>
This allows you to have a value passed to the drilldown that is not visible in the table you drilled down from. In the case above, imagine having a date like "2017-10-19" in the table you drill down from while you need it as "19.10.2017" in your target search.
Based on your comments, what you might be looking for is something like this:
<table>
<search>
<query>data=A | table info date</query>
</search>
<drilldown>
<eval token="drilldown_token">strftime(strptime('row.date', "%F"), "%d.%m.%Y")</eval>
</drilldown>
</table>
...
<table depends="$drilldown_token$">
<search>
<query>data=B | search other_date="$drilldown_token$"</query>
</search>
</table>
This allows you to have a value passed to the drilldown that is not visible in the table you drilled down from. In the case above, imagine having a date like "2017-10-19" in the table you drill down from while you need it as "19.10.2017" in your target search.
Yes!!!! That's it! Thank you very much!
Just an update, this wasn't working for me but I found a way to do it, so in case that helps anyone, this is what I did:
<drilldown>
<eval token="EOEDDE">strftime('earliest',"%d/%m/%y")</eval>
<eval token="EOEDDL">strftime('latest',"%d/%m/%y")</eval>
<set token="EOEDD">$earliest$</set>
<set token="EOLDD">$latest$</set>
</drilldown>
I used "EOEDDE" and "EOEDDL" for the panel title. "EOEDD" and "EOLDD" to generate results to a table.
Hi pamcarvalho,
create your search, e.g.:
index=my_index
| table _time field1 field2 hidden_field
in the panel options put the tag
<fields>_time,field1,field2</fields>
then in drilldown you can use hidden_field
Bye.
Giuseppe
But that only works assuming that someone clicks on the table right? Is there a way do display the field value without depending on that?
For example, a hidden panel that has a table with only one field value. Is it possible to drilldown this value?
a drilldown starts always from a click on a Splunk object!
Do you want to automatically open a dashboard from another one?
Why?
bye.
Giuseppe
No, l want to drilldown a value, change its format and then drilldown the new value. But the intermediary value shouldn't show up.. Not sure if I made myself clear..