Is there a way to setup a condition for drilldown ...

kiamco · ‎08-13-2018

So I have to scenarios

When user click on the no-event value a dashboard appers with a query that would probably contain something like:

level=$level$ NOT event=*
|eval ms_region=rtrim(ms_zone, "abcdefgh")
|where ms_region="$region$"

When user click on any event that is not labeled as 'no-event' search would be something like:

level=$level$
event=$event$
|eval ms_region=rtrim(ms_zone, "abcdefgh")
|where ms_region="$region$"

renjith_nair · ‎08-14-2018

@kiamco,

Try this <eval token="event_token">if($click.value2$=="","*",$click.value2$)</eval>

Sample dashboard with run anywhere example

<dashboard>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults count=5|eval event="someevenet",noevent=""</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <eval token="event_token">if($click.value2$=="","*",$click.value2$)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <html>
      <h1>This is the token value : <font color="red">$event_token$</font></h1>
    </html>
  </row>
</dashboard>

Happy Splunking!

Is there a way to setup a condition for drilldown based on the clickvalue?

.conf24 | Registration Open!

ICYMI - Check out the latest releases of Splunk Edge Processor

Introducing the 2024 SplunkTrust!