topic Hide search query in drilldown in Splunk Enterprise

Hide search query in drilldown

praphulla1 — Wed, 14 Jul 2021 16:53:37 GMT

Hello,

when user clicks on panel for drill-down, it shows relevant record in new window. I am looking to hide the search query to end- user ?

I could see some params in drill-down url

display.page.search.mode=verbose
dispatch.sample_ratio=1
display.general.type=statistics

But nothing related to hiding search query. Is this feasible by passing any additional parameter to the drill-down.

here's sample dashboard to explain in more detail.

<dashboard> <label>test</label> <description>Test dashboard</description> <row> <panel> <chart> <title>Stats in pie chart</title> <search> <query>index=_internal sourcetype=splunkd log_level=ERROR | stats count by host</query> <earliest>-60m@m</earliest> <latest>now</latest> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> </dashboard>

when you click on on slice of the pie chart. it opens a new tab where search query visible to user which i would like to hide it to end user.

Re: Hide search query in drilldown

ITWhisperer — Wed, 14 Jul 2021 15:45:31 GMT

You can use standard query strings on the url e.g. ?display.page.search.mode=verbose&dispatch.sample_ratio=1

Is that what you are after?

Re: Hide search query in drilldown

praphulla1 — Wed, 14 Jul 2021 15:53:01 GMT

@ITWhisperer i am looking for a param to hide the query to end-user.

i updated my question to be more clear.

Re: Hide search query in drilldown

ITWhisperer — Wed, 14 Jul 2021 15:56:30 GMT

What url are you drilling down to?

Re: Hide search query in drilldown

kamlesh_vaghela — Wed, 14 Jul 2021 16:06:41 GMT

@praphulla1

If you want to hide search or make it un-clickable then tried this in XML?

You can share your sample code so we can help.

Re: Hide search query in drilldown

praphulla1 — Wed, 14 Jul 2021 16:55:06 GMT

I am using auto drill-down.

<splunk instance>/search?q=search%20index%3D_internal%20sourcetype%3Dsplunkd%20log_level%3DERROR%20%20%20host%3Dabcd&earliest=1626277980&latest=1626281619&sid=1626281625.6156433_11E2866B-AB2E-4342-8D51-4948AA7A5661&display.page.search.mode=fast&dispatch.sample_ratio=1

Re: Hide search query in drilldown

praphulla1 — Wed, 14 Jul 2021 16:56:06 GMT

@kamlesh_vaghela i have more details to the question with sample dashboard code as well.

Re: Hide search query in drilldown

ITWhisperer — Wed, 14 Jul 2021 18:09:36 GMT

So you are drilling down to a search and you want to hide the fact that you are drilling down to a search?

Can you drilldown to another dashboard that has the results of the search (rather than the search app itself)?

Re: Hide search query in drilldown

praphulla1 — Wed, 14 Jul 2021 18:56:16 GMT

@ITWhisperer Yes. i have few dashboards which are using really long queries and on drill-down the query almost takes half of the screen.

i wanted to re-use the auto drill-down feature without need to build another drill-down dashboard.