Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to set up in-page drilldown with different tokens

$
0
0
For a single in-page drilldown, the following codes work as expected from "master1" table. How can I set up an in-page drilldown from either either token from "master1" or "master2"?
| inputlookup usage.csv0rangerangeusage<1%usage<1%-7d@hnow
Total processindex=xxxxxx sourcetype="xxxxxxxx" range="$p_usage$" | stats dc(host) AS count by process | sort - count$p_time.earliest$$p_time.latest$$row.process$
Total Workstationindex=xxxxxx sourcetype="xxxxxxxx" range="$p_usage$" | stats dc(process) AS count by host | sort - count$p_time.earliest$$p_time.latest$$row.host$
Detail: $tk_process$index=xxxxxx sourcetype="xxxxxxxx" process="$tk_process$" | dedup host process | table host process$p_time.earliest$$p_time.latest$

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>