Dashboards & Visualizations

How to pass more than 2 values when clicking on a row for drill down search?

asingla
Communicator

SimpleResultTable passes the value for the fist column as click.value when user clicks on a row. Is it possible to have access of all the column values (click.value2, click.value3...) when user clicks on a row for the drill down search?

2) Is it possible to hide a column (first one) in the SimpleResultTable and then pass this hidden column value when user clicks on a row?

wwhitener
Communicator

Splunk lets you record 4 values from a click.

click.name = click.value
click.name2 = click.value2

I'd suggest using a simple header to make sure that those cover whatever values you want--especially if you end up with a split-by clause in your query. Since you can nest the tables, you might be able to do more, but I haven't tried it. Otherwise, give the sideview stuff a try and let us know how it works out.

0 Karma

sideview
SplunkTrust
SplunkTrust

click.name and click.value are the column header, and the cell value, respectively, of the first column. Sorry for extra commas but it's a mouthful. As for click.name2 and click.value2 -- in "row" drilldown where the entire row lights up yellow onmouseover, those will always be identical to the first pair. In "cell" aka "all" configuration, those will be the column and cell value respectively of the cell that the user happened to click on. Unfortunately outside of occasional "split by" use cases, you'll usually be using "row" drilldown, and as such you really only have the first cell.

0 Karma

sideview
SplunkTrust
SplunkTrust

The first is not possible with just the core SimpleResultsTable. However if you use Sideview Utils ( http://splunk-base.splunk.com/apps/22279/sideview-utils ) in your app, and you follow it's instructions and embedded documentation, its code patches the SimpleResultsTable module to provide additional keys.

Specifically, you get $click.fields.someFieldName$ $click.fields.someOtherFieldName$, etc... for all the cells in the row, and you also get $click.cell0.value$, $click.cell7.value$, in case that's ever useful...

As far as your second question, I have implemented this in several apps, but only by adding some custom code to the app. I'm afraid the approach is a little too involved to lay out here.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...