Splunk Drilldown Tokens: $row.<fieldname>$ (Part-IV)
In this series of Splunk drilldown tokens we will try to cover all the possible aspects of Splunk drilldown functionalities from basic drilldown features like the link to search, link to the dashboard, and link to URL to advanced feature all drilldown tokens and many more insight ideas of Splunk advance drilldown. So if you are interested in making your dashboard customizable and interactive then stay tuned to the Splunk drilldown series.
Part-I : Splunk Drilldown Tokens: $click.name$ (Part-I)
Part-II : Splunk Drilldown Tokens: $click.value$ (Part-II)
Part-III : Splunk Drilldown Tokens: $click.value2$ and $click.name2$ (Part-III)
In this first blog of the series, we will cover all aspects of $click.value$ token,
- Chart viz: $row.<fieldname>$ for chart
- Table viz: $row.<fieldname>$ for table
- Event viz: $row.<fieldname>$ for event
$row.<fieldname>$ for chart:
It passes the field value of the selected fields mentioned in the token from the Y-axis.
Example:
I have a chart viz added into my dashboard like this,
In the X-axis I have “_time” and in the Y-axis I gave “bytes”. Now will add $click.value$ token to pass the X-axis field-value from the “_time” field.
Now if I only want to select values from the “bytes” field from the clicked location. For that purpose I will pass $row.bytes$ as you can see in the place of <fieldname>, I mentioned the field name whose value I want to pass.
If you don’t know how to add drilldowns tokens please refer to our first blog of this series. Only difference is that in place of “$click.name$” will pass “$row.<fieldname>$” or $row.bytes$.
Result:
Now to see what the token is passing I added an extra panel side of that to see.
And the query of that panel is given below,
| makeresults |eval new=”$new$”|fields new
Within the new field, you can see I passe the newly created token, always remember you need t put your token within the “$$” (dollar sign). Otherwise, Splunk won’t recognize its remarks as a token.
Now if I click on the chart it will pass clicked values from the “bytes” field from the chart viz with the help of the “$click.<fieldname>$” token.
So as you can from the clicked location bytes value is passed onto the next panel.
$row.<fieldname>$ for table:
with the table viz “$row.<fieldname>$” will pass value from the mentioned field name from the token for clicked location.
Example:
I have this table,
Now I added the drilldown in the same fashion as shown previously.
Result:
Now if I click anywhere in the table it will pass values from the leftmost field of the table i.e. “Bytes”
Hope you all enjoyed this blog “Splunk Drilldown Tokens: $click.value$ (Part-II)”. Will will back with the next part of this series which will cover “$click.value2$” and “$click.name2$”.
