Dashboards & Visualizations

How to pass more than 2 values when clicking on a row for drill down search?

asingla
Communicator

SimpleResultTable passes the value for the fist column as click.value when user clicks on a row. Is it possible to have access of all the column values (click.value2, click.value3...) when user clicks on a row for the drill down search?

2) Is it possible to hide a column (first one) in the SimpleResultTable and then pass this hidden column value when user clicks on a row?

wwhitener
Communicator

Splunk lets you record 4 values from a click.

click.name = click.value
click.name2 = click.value2

I'd suggest using a simple header to make sure that those cover whatever values you want--especially if you end up with a split-by clause in your query. Since you can nest the tables, you might be able to do more, but I haven't tried it. Otherwise, give the sideview stuff a try and let us know how it works out.

0 Karma

sideview
SplunkTrust
SplunkTrust

click.name and click.value are the column header, and the cell value, respectively, of the first column. Sorry for extra commas but it's a mouthful. As for click.name2 and click.value2 -- in "row" drilldown where the entire row lights up yellow onmouseover, those will always be identical to the first pair. In "cell" aka "all" configuration, those will be the column and cell value respectively of the cell that the user happened to click on. Unfortunately outside of occasional "split by" use cases, you'll usually be using "row" drilldown, and as such you really only have the first cell.

0 Karma

sideview
SplunkTrust
SplunkTrust

The first is not possible with just the core SimpleResultsTable. However if you use Sideview Utils ( http://splunk-base.splunk.com/apps/22279/sideview-utils ) in your app, and you follow it's instructions and embedded documentation, its code patches the SimpleResultsTable module to provide additional keys.

Specifically, you get $click.fields.someFieldName$ $click.fields.someOtherFieldName$, etc... for all the cells in the row, and you also get $click.cell0.value$, $click.cell7.value$, in case that's ever useful...

As far as your second question, I have implemented this in several apps, but only by adding some custom code to the app. I'm afraid the approach is a little too involved to lay out here.

Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...