topic Re: Using Value from Rex Command in Interactive Drilldown Dashboard in Dashboards & Visualizations

Using Value from Rex Command in Interactive Drilldown Dashboard

ramuzzini — Mon, 14 Oct 2024 18:24:35 GMT

Need help with creating an interactive drill down with value extracted using the rex command. I want to monitor users saving files to a certain folder and also sort and look at file extension types that are saved in folder and by who. Raw test data has: time, user, computer, directory and document as seen below.

Test Data
_time user_name computer_name source_directory document
10/11/2024 user1 Destop_user1 \\cpn-local\priv\cus\ document1.pdf
10/11/2024 user4 Destop_user1 \\cpn-local\priv\cus\ document2.doc
10/10/2024 user1 Destop_user1 \\cpn-local\priv\cus\ document3.pdf
10/10/2024 user2 Destop_user2 \\cpn-local\priv\cus\ document4.pdf
10/9/2024 user3 Destop_user3 \\cpn-local\priv\cus\ document5.pdf
10/9/2024 user4 Destop_user4 \\cpn-local\priv\cus\ document6.doc
10/9/2024 user2 Destop_user2 \\cpn-local\priv\cus\ document7.doc

I have created a drill using a token value of the queried data from the raw logs which allows me to selecte a user from a pie chart and show all logs in a second table. Those two dashboard panels are below and work.

***User Pie Chart with the drilldown token: token_user=$click.value$ ***
index="user_files"
| rex field="document" "\.(?<extension>[^\.]*$$)"
| stats count(user_name) BY user_name

***User Record Table ***
index="user_files" user_name = $token$
| table _time, user_name, computer_name, source_directory, document

I am now trying to create a dashboard taking the same raw data, add a rex command to filter out extension and have the pie chart show the specific file extension I have logs from an index which I have done using the following query

*** File Extension Pie Chart: Works ***
index="user_files"
| rex field="document" "\.(?<extension>[^\.]*$$)"
| stats count(extension) by extension

However, when I call on the token "source = $token$" after declaring the index to display records based on pie chart selection, there is no search results.

*** Records by file type selected in Pie Chart: No Records found with selection from Pie Chart **
index="user_files" source=$*token$
| table _time, user_name, computer_name, source_directory, document

I also tried (index="user_files" extension=$*token$") and ("|where extension="$token$") in the query and still no results are seen in the record table.

Any help would be greatly appreciated. I understand the logic needed, just having problems executing the drill down. Thanks

Re: Using Value from Rex Command in Interactive Drilldown Dashboard

PickleRick — Mon, 14 Oct 2024 18:30:54 GMT

$*token$ - what is it supposed to be? Maybe, just maybe *$token$ could work. Definitely not the way you're trying to do. You have no token named "*token"

Re: Using Value from Rex Command in Interactive Drilldown Dashboard

ramuzzini — Mon, 14 Oct 2024 22:07:37 GMT

The token value I am trying to carry over in my table is the(token=$click.value$) using the field extracted In the drilldown editor. I have my values/parameters set to:

on click set "token"= $click.value$. I named my token name "Token" in the drilldown editor for simplicity.

In initial post I stated ***User Pie Chart with the drilldown token: token_user=$click.value$ ***
but should by
***User Pie Chart with the drilldown token: "token"=$click.value$ ***

*** File Extension Pie Chart with the drilldown token: "token"=$click.value$ ***

index="user_files" | rex field="document" "\.(?<extension>[^\.]*$$)" | stats count(extension) by extension

However, when I call on the token "source = $token$" after declaring the index to display records based on pie chart selection, there is no search results.

*** Records by file type selected in Pie Chart: No Records found with selection from Pie Chart **

index="user_files" source=$*token$ | table _time, user_name, computer_name, source_directory, document

Apologize for the confusion. Hope that clears it up a little.

Re: Using Value from Rex Command in Interactive Drilldown Dashboard

PickleRick — Mon, 14 Oct 2024 19:03:06 GMT

It's no confusion. I meant to show you that you're trying to use a token named "*token". Even if it was syntactically correct which I doubt - I think the token name syntax is more restricted - it would still be a different token than the one you have defined.

If you define a token named "token" you use it as $token$, not $*token$, not $my_token$, not $token_I_forgot_about$. These are all different literals.

Re: Using Value from Rex Command in Interactive Drilldown Dashboard

ramuzzini — Mon, 14 Oct 2024 19:07:15 GMT

That was a type, copy and pasted. My token I am using in my search string is (source=$token$) Not sure where/why I added the (*) in the token name.

Re: Using Value from Rex Command in Interactive Drilldown Dashboard

ramuzzini — Mon, 14 Oct 2024 19:16:18 GMT

Realizing I need to run the rex command in my table because Splunk doesn't have any value in that search fin the raw data to associated with the token. Going to try some alternative queries for now to see if I can come up with the solution now considering that.

Re: Using Value from Rex Command in Interactive Drilldown Dashboard

ramuzzini — Mon, 14 Oct 2024 19:39:36 GMT

Figured it out:

*** File Extension Pie Chart: Works ***
index="user_files"
| rex field="document" "\.(?<extension>[^\.]*$$)"
| stats count(extension) by extension

However, when I call on the token "source = $token$" after declaring the index to display records based on pie chart selection, there is no search results.

*** Records by file type selected in Pie Chart: No Records found with selection from Pie Chart **
index="user_files"
| rex field="document" "\.(?<extension>[^\.]*$$)"
| where extension = "$token$"
| table ...

Thanks PickleRick for given a response in helping figure this out. Much appreciate.