point to events for aggregate functions

pratibha2018 — Fri, 20 Apr 2018 10:25:17 GMT

Hi ,

So, I have a dashboard containing search query like :

search query | stats max(field1) by field2

but when I want to see the events for a particular point it leads me to all results for field1 rather than the showing events for field1= max(field1) and field2=result2(selected point for).

Any suggestions, please?

Re: point to events for aggregate functions

niketn — Tue, 29 Sep 2020 19:05:27 GMT

Try the following Run anywhere dashboard example based on Splunk's _internal index. It passes on the value of max(date_seconds) to a new search (using predefined drilldown token $click.value2$ ) which opens in new window.

<form>
  <label>Max Field Value for Drilldown</label>
  <fieldset submitButton="false">
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats max(date_second) as date_second by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">search?q=index=_internal sourcetype=splunkd log_level=* date_second="$click.value2$"&amp;earliest=$tokTime.earliest$&amp;latest=$tokTime.latest$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

Re: point to events for aggregate functions

pratibha2018 — Mon, 23 Apr 2018 05:27:39 GMT

This works.

Thanks, @niketnilay!

topic point to events for aggregate functions in Dashboards & Visualizations

point to events for aggregate functions

Re: point to events for aggregate functions

Re: point to events for aggregate functions