Dashboards & Visualizations

How to combine two tables and make the drilldown work as normal?

bkumarm
Contributor

I have two tables that are generated out of queries as below:

Search1:

eventtype="Myown" source="*File1*" | dedup ID| eval A1=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg | eval S1=if(A1="Pass", "Pass", "Fail") | transaction ID keepevicted=t | table _time, ID,  Error, S1,  A1

Search2:

eventtype="Myown" source="*File2*"  |  dedup ID | eval S2=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg | transaction ID keepevicted=t | table _time, ID,  Error,  S2

These two searches generate tables and behave as expected.
Next I am combining them into one using append as below:

eventtype="Myown" source="*File1*" | dedup ID| eval A1=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg | eval S1=if(A1="Pass", "Pass", "Fail") |  append [search eventtype="Myown" source="*File2*"  |  dedup ID | eval S2=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg] | transaction ID keepevicted=t | table _time, ID,  Error,  S2

The table comes up correctly and the values are shown properly.
When I click on any cell, that provides me drill down to the log entry properly.
However, at this point when I click Actions and show source, it is throwing an error and does not display the source.

any suggestions?

0 Karma

sundareshr
Legend

What error are you getting? You cannot see source when you use transaction. Remove the transaction command. You should still get the desired results. But, again, I think you will get an error when you click on the row generated by the sub-search.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...