topic Re: Creating a report that progressively narrows the data set in Dashboards & Visualizations

Creating a report that progressively narrows the data set

amanteja — Tue, 30 Jul 2013 15:37:48 GMT

Imagine that we are sending data that has the following fields in every event
time, userid, thread ...

Would like to create a forms where the on call engineer can

Start by selecting a time range
He/she is now able to view all the user ids in that time range in a drop down
Now the engineer can select a user. On doing that the engineer is able to view the list of all the thread ids that this user has made requests in the given time period (again a dropdown)
And so on...

To finally arrive at a small subset of logs that he/she should inspect. Is this doable? Could you point me to a sample?

Re: Creating a report that progressively narrows the data set

martin_mueller — Wed, 31 Jul 2013 12:53:08 GMT

That's doable.

In short, this could be an approach:

time range picker
feed time range into a search for user ids, populating a pulldown
feed time range and user id into a search for thread ids, populating a pulldown
and so on
feed all params to the final search, yielding your desired events

Depending on your data, it's probably smart to have commonly used fields filled from prepared lookups to speed things up.

Re: Creating a report that progressively narrows the data set

amanteja — Wed, 31 Jul 2013 13:10:06 GMT

Thanks.
In the second form- as soon as the user has picked a userid (prepopulated by query) how does one transition to the next form WITHOUT showing the results to the user and having him click on that as documented here http://docs.splunk.com/Documentation/Splunk/5.0.3/Viz/Dynamicdrilldownindashboardsandforms#Dynamic_drilldown_examples

Re: Creating a report that progressively narrows the data set

martin_mueller — Wed, 31 Jul 2013 13:19:00 GMT

I had something a little different in mind - one Advanced XML view with a tree of pulldowns. A bit like the SideviewUtils doc on "Pulldown - reusing searches with 'postProcess'", available under Key Techniques if you have Sideview Utils v2 (get it from http://sideviewapps.com/apps/sideview-utils/ - you really should!).