Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to edit the XML for my dashboard table drilldown to only display log data specific to the attribute I click on?

$
0
0
Hi, My team and I are working on a project and we are trying to open data logs within our dashboard. Our current XML code enables us to open the data logs in the dashboard, but it opens all the logs within the server. So given any attribute that we click on the table, all the data logs are displayed instead of just the data log specific to that attribute. Is there a way I can fix that so only the log related to the attribute is displayed? This is the XML source we have so far:
*
Genesys ServerAvaya Tserverindex=windowsapps sourcetype=Genesys_AvayaTserver "$tok_ID$" | rex"(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?<EventName>\w+)"| rex"AttributeConnID'?\s'?(?<AttributeConnID>[^\t\n\r]+)"| rex"AttributeANI'?\s'?(?<AttributeANI>[^\t\n\r]+)"| rex"AttributeDNIS'?\s'?(?<AttributeDNIS>[^\t\n]+)"| rex"AttributeCallType'?\s'?(?<AttributeCallType>[^\t\n]+)"|rex"AttributeCallUUID'?\s'?(?<AttributeCallUUID>[^\t\n]+)"|rex"AttributeUserData'?\s'?(?<AttributeUserData>[^\t\n]+)"|table_time EventName AttributeConnID AttributeANI AttributeDNIS AttributeCallType AttributeCallUUID AttributeUserData| where isnotnull(AttributeANI)-30d@dnowtrue$click.value$-1$click.value$+1$row.AttributeConnID$$row.AttributeANI$$row.AttributeCallType$$row.AttributeDNIS$$row.AttributeCallUUID$
index=windowsapps sourcetype=Genesys_AvayaTserver earliest=$e$ latest=$l$ | rex "(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?<EventName>\w+)"| rex "AttributeConnID'?\s'?(?<AttributeConnID>[^\t\n\r]+)"| rex "AttributeANI'?\s'?(?<AttributeANI>[^\t\n\r]+)"| rex "AttributeDNIS'?\s'?(?<AttributeDNIS>[^\t\n]+)"| rex "AttributeCallType'?\s'?(?<AttributeCallType>[^\t\n]+)"| rex "AttributeCallUUID'?\s'?(?<AttributeCallUUID>[^\t\n]+)"| rex "AttributeUserData'?\s'?(?<AttributeUserData>[^\t\n]+)"

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>