0

I am gathering performance metrics for each each api that we have. With the below query I get results as

method response_time
Create Billing 2343.2323

index="dev-uw2" logger_name="*Aspect*" message="*ApiImpl*"  | rex field=message "PerformanceMetrics - method='(?<method>.*)' execution_time=(?<response_time>.*)" | table method, response_time   | replace "public com.xyz.services.billingservice.model.Billing com.xyz.services.billingservice.api.BillingApiImpl.createBilling(java.lang.String)” WITH "Create Billing” IN method

If the user clicks on each api text in table cell to drill down further it will open a new search with "Create Billing" obviosuly it will give zero results since we don't have any log with that string.

I want splunk to search with original text that was replaced earlier.

Community
  • 1
  • 1
Kiran
  • 839
  • 3
  • 15
  • 45

1 Answers1

0

You can use click.value to get around this.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/tokens

skoelpin
  • 212
  • 1
  • 5