- #SPLUNK SIDEVIEW SHOWHIDE EXAMPLE HOW TO#
- #SPLUNK SIDEVIEW SHOWHIDE EXAMPLE MANUAL#
- #SPLUNK SIDEVIEW SHOWHIDE EXAMPLE SERIES#
If that's what you actually wanted, let me know and I can modify this answer, but again there are tons of docs in Sideview Utils and there's a whole page talking about inline drilldown, how it works and the $foo$ tokens available etc.1 Splunk IT Service Intelligence Service Insights Manual Cloud only Generated: 7:24 am Copyright (c) 2020 Splunk Inc. And you can reference any selected field value from that Table row as $$. If you nest the Pulldown inside the Table, then it will remain invisible until a row in the Table is clicked.
Although this is certainly possible and very easy to do, since you make no other mention of inline drilldown, I'm making the assumption that you do not want that. In your diagram, you're showing the Pulldown downstream from the Table, which would technically be an inline drilldown config.
#SPLUNK SIDEVIEW SHOWHIDE EXAMPLE SERIES#
Search series="$selectedSourcetype$" | chart max(ma圎ps) as ma圎ps over series by date_hour Index=_internal source="*metrics.log" group="per_sourcetype_thruput" $seriesFilter$ | stats sum(kb) as KB max(eps) as ma圎ps count by series, date_hour I went ahead and cribbed from all the working examples in the Sideview Utils docs, to make an example that matches your exact use case.
#SPLUNK SIDEVIEW SHOWHIDE EXAMPLE HOW TO#
Other pages thereafter add on to that base knowledge by showing you more examples of optional params and how to do multiselect and how to prepopulate and redirect etc.Īnd you can use Pulldown to fill tokens into PostProcess searches as well as downstream Searches with no problem. The second page though is dedicated to dynamic configurations. The first page goes over just the "static" configurations, where you hardcode the option list into the view. Have you checked out the documentation? There are many pages of docs guiding you through Pulldown. This is just the standard way in which you use the Pulldown module.
0 kommentar(er)
