Sorry for the mouthful in the title.
I'm using a drilldown in the XML for a component in a dashboard which worked fine until I changed the query building the component to use 'eval'.
Originally I'd be able to click the cell, get the string within, and open a new tab in the browser with a separate custom search going using that cell's string.
I changed the backend query to get the table's data a different way. I'd like to launch a new search with the cell's string. What I did in the process was, for the moment, just using the URL for the search I wanted, except with $click.value$ inserted to get the unique result. Probably not the best way in general (any tips?) but it suited my needs for that particular moment.
However, I have a newer search query for the functionality I want. The data itself displays just fine in the table. But when I click a cell, I get redirected to a new search that pretty much uses the original search query (the newest one that uses eval), except it inserts the cell's string as a qualifier, so that the new results are filtered down just to events with that string. Technically that's right, but I don't want the new search to use eval at all. It should pretty much do what I had it do before, which is just "index=... etc. | table "A", "B". The weird thing is that I double checked the XML "source" and my drilldown link is still there..
I hope that use case makes sense... Is it possible it has to do with how I start the new search? I looked through this Answers board a bit as well as the docs and I have to say I'm a bit confused on the best way to just drilldown to a new search using SimpleXML, not Advanced XML.
Thanks!
↧