How To Use Drilldown Token ($click.value$ and $click.value2$) In Splunk
Hello guys!!!
Today we have come with another topic, how to use $click.value$ and $click.value2$ in Drilldown.
We all know that through Dashboard is used for different visualizations in Splunk. But for making dashboard more interactive we use Drilldown .
Drilldown action is used for getting refined search based on where the user clicks like on a row or cell etc.
There are different types of Drilldown action present to use Drilldown in many ways.
Today we will show you the action “Manage tokens on this dashboard”.
For doing this we will use the tokens $click.value$ and $click.value2$
Lets start with “$click.value$”
Step1:
Login to Splunk using your credentials.
Step2:
Go to Search and Reporting app.
Step3:
We have created a sample Dashboard and given the name “Drilldown ($click.value$)”
The query for the “First Panel” is ,
index=_internal sourcetype=splunkd_ui_access
| table method,status,bytes
| dedup method,status,bytes
The query for the “Second Panel” is,
index=_internal sourcetype=splunkd_ui_access
| eval NEW="$one$"
[$one$ is the drilldown token and the visualization of this panel we have changed to “Single Value” ]
Step4:
Now, click on the Edit option at the upper-right corner in the Dashboard.
Step5:
Now, go to the button marked in the below screenshot and click on “Edit Drilldown”.
Step6:
In the “on click” option go for “Manage tokens on this dashboard”.
Step7:
Now, here you have to mention the token name and the type of the token.
See the below screenshots.
Here, we have mentioned “one” as the token name and $click.value$ is the type of the token
Then, click on Apply to make the changes.
In the “Second Panel” we have already passed the drilldown token $one$. So no need to make any changes there.
Now, Click on Save to save all the changes.
Step8:
$click.value$ represents always the value of left most field of a panel depending upon which row you are clicking.
These means if you have three columns in a panel of a dashboard i.e. method, status, bytes
Now if you click on any row of the status or bytes field then also you will get the result of the corresponding method field value because method is the left most field here.
See the below screenshots.
Here, by clicking on the first row of the method field, according to the query of the “Second Panel” we are getting the field value “POST”
But, here we are clicking on the field values “263” from “bytes” field, but still we are getting the value “GET” which is the corresponding method field value for “263”.
Now, we are clicking on the field value “200” from “status” field[in the first row of “status” field], but we are getting the value “POST” which is the corresponding method field value for “200”.
Now, the next is $click.value2$.
Follow the above mentioned Step1 and Step2.
Step3:
We have created a sample Dashboard and given the name “Drilldown ($click.value2$)”
The query for the “First Panel” is ,
index=_internal sourcetype=splunkd_ui_access
| table method,status,bytes
| dedup method,status,bytes
The query for the “Second Panel” is,
index=_internal sourcetype=splunkd_ui_access
| eval NEW="$two$"
[$two$ is the drilldown token]
Follow the above mentioned Step4 to Step 6 are same as for $click.value2$.
Step7:
Now, here you have to mention the token name and the type of the token.
See the below screenshots.
Here, we have mentioned “two” as the token name and $click.value2$ is the type of the token.
Then, click on Apply to make the changes.
In the “Second Panel” we already have passed the drilldown token $two$. So no need to make any changes there.
Now, Click on Save to save all the changes.
Step8:
$click.value2$ always represents the field-value of a particular cell you are clicking inside a panel of a Dashboard.
These means if you have three columns in a panel of a dashboard i.e. method, status, bytes
Now, if you will click on a cell of method field you will only get value of that particular cell of method field only.
If you will click on a cell of status field you will get value of that cell of status field only.
See the below screenshots.
See, here in the “First Panel” we have clicked on the first cell of method field which contains “GET” and in the “Second Panel” we got “GET”
Here in the “First Panel” we have clicked on the first cell of status field which contains “200” and in the “Second Panel” we got “200”
Here in the “First Panel” we have clicked on the first cell of bytes field which contains “7400” and in the “Second Panel” we got “7400”
Hope this blog will help you to understand the usage of $click.value$ and $click.value2$.
Happy Splunking !!
[…] How To Use Drilldown Token ($click.value$ and $click.value2$) In Splunk […]