DrillDown Table

Question

alt text

How to put | search splunk_web_service="574.357430" before | rex command in drilldown table?

I mean, after click on value in drilldown table I want search like:

index=test sourcetype="test" splunk_web_service="574.357430" | rex ....

Accepted Answer

If you're using the advanced XML, (and I gather from the nature of your quesstion that you're using the 'addterm' intention), then you can add an 'indexed' flag to the intention

Intention syntax is ugly, but here's an addterm intention that adds myField="myValue", and note the last line -- that directive tells the intention system not to try and be clever, but to put the given term in the first search clause always.

<param name="intention">
  <param name="name">addterm</param>
  <param name="arg">
    <param name="myField">myValue</param>
  </param>   
  <param name="flags"><list>indexed</list></param>
</param>

DrillDown Table

Follow this question

Splunk Resources

Related questions