topic Re: Dashboard search token in Dashboards & Visualizations

Dashboard search token

becksyboy — Mon, 19 Feb 2018 20:19:39 GMT

Hi All,

im trying to learn about search tokens within the same dashboard, but not having much luck. I've set up a simple test dashboard with two panels, both are tables. I would like a search token defined for search A and used in search B for the RecordNumber field. Is it possible without a field input shown on the dashboard?

Search A:
index="wineventlog" LogName=Security | table EventCode RecordNumber

Search B:
index="wineventlog" LogName=Security RecordNumber=* | dedup RecordNumber| table RecordNumber

thanks

Re: Dashboard search token

somesoni2 — Mon, 19 Feb 2018 22:25:16 GMT

Good doc pages on the same:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/ContextualDrilldown
http://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/tokens

Re: Dashboard search token

493669 — Tue, 20 Feb 2018 02:31:00 GMT

you can use drilldown in first table like:

 <drilldown>
          <condition field="RecordNumber">
            <set token="selected_RecordNumber">$click.value2$</set>
          </condition>
 </drilldown>

then use $selected_RecordNumber$ token in second table query like:

index="wineventlog" LogName=Security RecordNumber=$selected_RecordNumber$ | dedup RecordNumber| table RecordNumber

Re: Dashboard search token

becksyboy — Tue, 20 Feb 2018 08:23:13 GMT

Thanks Rajesh, i could only get this to work if i set search A with the drilldown option name to cell. So if i click on a RecordNumber from the Search A table, the value is shown in the Search B table. Is there a way to dynamically show all the results for the table in Search B>?

Re: Dashboard search token

becksyboy — Tue, 20 Feb 2018 08:24:11 GMT

Thanks somesoni2 i've been reading these docs, very helpful, with alot to pick through and understand.

Re: Dashboard search token

493669 — Tue, 20 Feb 2018 09:10:21 GMT

Dynamically show all the results means? can you explain in detail that on click on table A what you are expecting in tableB

Re: Dashboard search token

becksyboy — Tue, 20 Feb 2018 17:03:23 GMT

Hi, i was hoping to see my table populated with results for all rows. Is that possible with a search token?

Re: Dashboard search token

493669 — Tue, 20 Feb 2018 17:33:36 GMT

can you provide sample table A and expected table B to get better understanding

Re: Dashboard search token

niketn — Tue, 20 Feb 2018 17:59:05 GMT

@becksyboy, intent of your Search A and Search B is not clear.

The Search A in the question returns All Events and All RecorNumbers (even duplicates). What is the purpose or the intent of this?

The Search B returns all unique RecordNumbers.

Please clarify the question as well I would like a search token defined for search A and used in search B for the RecordNumber field. Is it possible without a field input shown on the dashboard?. What do you want to do here?

Re: Dashboard search token

becksyboy — Tue, 20 Feb 2018 20:47:53 GMT

I suppose my example searches are more for a learning/understanding point of view, so perhaps they may not be the best. However, below are the tables i have on my test dashboard. So can a search token power search B to show all rows?

Search A:
EventCode RecordNumber
4624 9000
4624 9000
4624 9000
4624 9001

Search B:
RecordNumber
9000
9001
9002
9003

Re: Dashboard search token

493669 — Wed, 21 Feb 2018 00:56:52 GMT

basically drilldown can be used to sort the results but here you are expecting full result set with only one column with unique value . so write below query in tableB

 index="wineventlog" LogName=Security  | dedup RecordNumber| table RecordNumber

but if you want this table B to be shown only after clicking on Table A then you can use depends in <panel>
firstly use below drilldown in tabelA panel:

<drilldown>
          <set token="count_field">$click.value$</set>
 </drilldown>

and now in second panel use depends:

<panel depends="$count_field$">

Re: Dashboard search token

becksyboy — Thu, 22 Feb 2018 09:39:48 GMT

Thanks Rajesh, this making sense; i'm getting a better understanding of this now.