Splunk Drilldown Tokens: $click.value$ (Part-II)

Splunk Drilldown Tokens: $click.value$ (Part-II)

In this series of Splunk drilldown tokens we will try to cover all the possible aspects of Splunk drilldown functionalities from basic drilldown features like the link to search, link to the dashboard, and link to URL to advanced feature all drilldown tokens and many more insight ideas of Splunk advance drilldown. So if you are interested in making your dashboard customizable and interactive then stay tuned to the Splunk drilldown series.

Part-I : Splunk Drilldown Tokens: $click.name$

In this first blog of the series, we will cover all aspects of $click.value$ token,

1. Chart viz: $click.value$ for chart
2. Table viz: $click.value$ for table
3. Event viz: $click.value$ for event
4. Single value viz: $click.value$ for trellis

$click.value$ for chart:

It passes the X-axis field or category value for the clicked location.

Example:

I have a chart viz added into my dashboard like this,

In the X-axis I have “_time” and in the Y-axis I gave “bytes”. Now will add $click.value$ token to pass the X-axis field-value from the  “_time” field.

If you don know how to add drilldowns tokens please refer to our first blog of this series. The only difference is that in place of “$click.name$” will pass “$click.value$”.

Result:

Now to see what the token is passing I added an extra panel side of that to see.

And the query of that panel is given below,

| makeresults 
| eval new="$new$"
| fields new

Within the new field, you can see I passe the newly created token, always remember you need t put your token within the “$$” (dollar sign). Otherwise, Splunk won’t recognize its remarks as a token.

Now if I click on the chart it will pass clicked values from the “_time” field from the chart viz with the help of the “$click.value$” token.

Here time passes in an epoch, so nothing to woory about.

$click.value$ for table:

with the table viz “$click.value$” will pass field values from the left-most field of the table.

Example:

I have this table,

Now I added the drilldown in the same fashion as shown previously.

Result:

Now if I click anywhere in the table it will pass values from the leftmost field of the table i.e. “Bytes”

$click.value$ for event:

for event viz whatever element you click that value will pass into that token.

Result:

$click.value$ for trellis single value:

in the case of trellis single value $click.value$ represents as $trellis.value$. It passes values from the split by field name from the viz.

Result:

Here we took the method as a split by field into the trellis. That’s why it is showing values from the method field.

Hope you all enjoyed this blog “Splunk Drilldown Tokens: $click.value$ (Part-II)”. Will will back with the next part of this series which will cover “$click.value2$” and “$click.name2$”.

Happy Splunking!!