topic Re: Drilldown on Dashboard not working properly in Splunk Cloud Platform

Why is drilldown on dashboard not working properly?

jhilton90 — Mon, 17 Apr 2023 21:14:38 GMT

I have a dashboard which displays information about password resets and I have a bar chart showing the top 20 accounts that have reset their passwords, code as follows:

index=keycloak "fields.environment"=production redirect_uri=* type=UPDATE_PASSWORD | rename customerReferenceAccountId as AccountID | top AccountID limit=20

This displays as a bar chat absolutely fine, however what I'm trying to achieve is to be able to click one of the bars in this chart, which will then display a table with AccountID, username, userId, redirect_uri, ipAddress, _time. Code as follows:

index=keycloak "fields.environment"=production customerReferenceAccountId=$AccountID$ type=UPDATE_PASSWORD | table $AccountID$, username, userId, redirect_uri, ipAddress, _time

In the first table I have set the "On Click" with a value of "Manage tokens on this dashboard" as follows: Set AccountID = $click.value$.

However, when I click on one of the bars, the table below isn't displaying any information, I just get "No results found" but I know that there are results

Re: Drilldown on Dashboard not working properly

ITWhisperer — Mon, 17 Apr 2023 14:44:53 GMT

index=keycloak "fields.environment"=production customerReferenceAccountId=$AccountID$ type=UPDATE_PASSWORD | table customerReferenceAccountId, username, userId, redirect_uri, ipAddress, _time

Re: Drilldown on Dashboard not working properly

jhilton90 — Mon, 17 Apr 2023 14:50:49 GMT

That doesn't work I'm afraid

Re: Drilldown on Dashboard not working properly

ITWhisperer — Mon, 17 Apr 2023 14:52:40 GMT

Try this

index=keycloak "fields.environment"=production customerReferenceAccountId=$AccountID|s$ type=UPDATE_PASSWORD | table customerReferenceAccountId, username, userId, redirect_uri, ipAddress, _time

Re: Drilldown on Dashboard not working properly

jhilton90 — Mon, 17 Apr 2023 14:55:39 GMT

Isn't that the same? I tried it but it didn't work

Re: Drilldown on Dashboard not working properly

woodcock — Mon, 17 Apr 2023 15:07:13 GMT

Run the dashboard.
Click "Edit".
Scroll to your panel.
In the upper-right corner, click on the snowman menu and select "Edit Drilldown".
In the popup that opens, select "Link to Search".
In the redrawn popup, select, "Custom".
Paste this in it: index="keycloak" AND fields.environment="production" AND customerReferenceAccountId="$click.value$" AND type="UPDATE_PASSWORD" | table AccountID, username, userId, redirect_uri, ipAddress, _time
Or maybe something like this: |inputlookup foo WHERE AccountID="$click.value$"
Save it all.

Re: Drilldown on Dashboard not working properly

ITWhisperer — Mon, 17 Apr 2023 15:05:15 GMT

No, it uses |s to make the token a string - without more detail on what your events look like and what exactly isn't working, it is a little difficult to make other suggestions. If you want more help, please provide more detail on what your issues are

Re: Drilldown on Dashboard not working properly

jhilton90 — Mon, 17 Apr 2023 15:06:15 GMT

No it's okay you were right, I had a typo

Thanks!