I am trying to create a dynamic dashboard utilizing splunk's custom token capability. I have a single value panel that is broken out in trellis format. The query for this panel is fairly simple: index = a sourcetype= b | stats avg(c) by d.
What I want is to have additional panels that will display information based on which trellis shape is chosen (aka a value of d).
For example the trellis format would have 3 boxes with values like abc (title) = 123 (value) , def = 3.33, ghi = 8.56. I want to be able to click on the box with title ghi and value 8.56 and show additional panels that include [d = ghi] in the panels query.
Does anyone know of a way to reference those values? I've tried using $click.name2$, $click.value2$, $results.d$ and some others...
TLDR:
When you set up the splunk auto drilldown search it gives me the value of d that I desire, but I can't recreate it using other dynamic drilldown options.
Actually - just figured it out. Posting reply in case others have this issue as well -
You can use the token = $trellis.value$ for searching on trellis split charts.
Happy Splunking!
Actually - just figured it out. Posting reply in case others have this issue as well -
You can use the token = $trellis.value$ for searching on trellis split charts.
Happy Splunking!