How To Use Drilldown Token ($click.value$ and $click.value2$) In Splunk

How To Use Drilldown Token ($click.value$ and $click.value2$) In Splunk      

Hello guys!!!

Today we have come with another topic, how to use $click.value$ and $click.value2$ in Drilldown.
We all know that through Dashboard is used for different visualizations in Splunk. But for making dashboard more interactive we use Drilldown .
Drilldown action is used for getting  refined search based on where the user clicks like on a row or cell etc.
There are different types of Drilldown action present to use Drilldown in many ways.
Today we will show you the action “Manage tokens on this dashboard”.
For doing this we will use the tokens $click.value$ and $click.value2$
Lets start with  “$click.value$”

Step1:
Login to Splunk using your credentials.

step1

Step2:
Go to Search and Reporting app.

step2

Step3:

We have created a sample Dashboard and given the name “Drilldown ($click.value$)”

The query for the “First Panel” is ,

index=_internal sourcetype=splunkd_ui_access 
| table method,status,bytes 
| dedup method,status,bytes

The query for the “Second Panel” is,

index=_internal sourcetype=splunkd_ui_access 
| eval NEW="$one$"

[$one$ is the drilldown token and the visualization of this panel we have changed to “Single Value”  ]

Step4:

Now, click on the Edit option at the upper-right corner in the Dashboard.

step4

Step5:

Now, go to the button marked in the below screenshot and click on “Edit Drilldown”.

step5

Step6:

In the “on click” option go for “Manage  tokens on this dashboard”.

step6

Step7:

Now, here you have to mention the token name and the type of the token.

See the below screenshots.

step7(1)

Here, we have mentioned “one” as the token name and  $click.value$ is the type of the token

step7(2)

Then, click on Apply to make the changes.

In the “Second Panel”  we have already  passed the drilldown token $one$. So no need to make any changes there.

Now, Click on Save to save all the changes.

step7(2.3)

Step8:

$click.value$ represents always the value of left most field of a panel depending upon which row you are clicking.

These means if you have three columns in a panel of a dashboard i.e. method, status, bytes

Now if you click on any row of the status or bytes field then also you will get the result of the corresponding method field value because method is the left most field here.

See the below screenshots.

Here, by  clicking on the first row of the method field, according to the query of the “Second Panel”  we are getting the field value “POST”

step8(1)

But, here we are clicking on the field values “263” from “bytes” field, but still we are getting the value “GET” which is the corresponding method field value for “263”.

step8(2)

Now,  we are clicking on the field value “200” from “status” field[in the first row of “status” field], but we are getting the value “POST” which is the corresponding method field value for “200”.

step8(3)

Now, the next is $click.value2$.

Follow the above mentioned Step1 and Step2.

Step3:

We have created a sample Dashboard and given the name “Drilldown ($click.value2$)”

The query for the “First Panel” is ,

index=_internal sourcetype=splunkd_ui_access 
| table method,status,bytes 
| dedup method,status,bytes

The query for the “Second Panel” is,

index=_internal sourcetype=splunkd_ui_access 
| eval NEW="$two$"

[$two$ is the drilldown token]

Follow the above mentioned Step4 to Step 6 are same as for $click.value2$.

Step7:

Now, here you have to mention the token name and the type of the token.

See the below screenshots.

step7(2.1)

Here, we have mentioned “two” as the token name and  $click.value2$ is the type of the token.

step7(2.2)

Then, click on Apply to make the changes.

In the “Second Panel”  we already have passed the drilldown token $two$. So no need to make any changes there.

step7(2.3)

Now, Click on Save to save all the changes.

Step8:

$click.value2$ always represents the field-value of a particular cell you are clicking inside a panel of a Dashboard.

These means if you have three columns in a panel of a dashboard i.e. method, status, bytes
Now, if you will click on a cell of method field you will only get value of that particular cell of method field only.
If you will click on a cell of status field you will get value of that cell of status field only.

See the below screenshots.
See, here in the “First Panel” we have clicked on the first cell of method  field which contains “GET” and in the “Second Panel” we got “GET”

step8(1)

Here in the “First Panel” we have clicked on the first cell of status field which contains “200” and in the “Second Panel” we got “200”

step8(2.2)

Here in the “First Panel” we have clicked on the first cell of bytes field which contains “7400” and in the “Second Panel” we got “7400”

step8(2.3)

Hope this blog will help you to understand the usage of $click.value$ and $click.value2$.

Happy Splunking !!

You can also know about :  How to Add Link List Input option to Splunk Dashboard
Advertisements

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.