topic drilldown whilst using a search w stats values() in Splunk Search

drilldown whilst using a search w stats values()

hiddenkirby — Sat, 15 May 2010 02:27:04 GMT

So this stemmed from a previous question, but i figured it warranted a new question. (hey more points for everyone)

I can't quickly think of a better example but if you do a search like the following... and select a username ... i guess i would expect to have it append " user=selectedcelltext".

index="sample" | stats values(user)

This would be a common issue for anyone running dashboards and wanted to see all the results for that user or something.

thoughts?

Re: drilldown whilst using a search w stats values()

sideview — Sat, 15 May 2010 06:26:00 GMT

It appears the drilldown code overall isnt capable of dealing with stats values(user). It may just be a little bug but it's quite possible that it's an undocumented limitation of the feature.

However this is a strange search to run in the first place, since you're going to get a single row with an enormous multivalued field containing every distinct value of user.

Change to running:

index="sample" | stats count by user

or just index="sample" | top user

Those will give you results where each row is the unique user and the drilldown will deal with it properly.

Re: drilldown whilst using a search w stats values()

hiddenkirby — Mon, 17 May 2010 20:48:09 GMT

Unfortunately the table i built for the dashboard (that my client requested) ... needs the "values" command. I'll have to see if i can get creative and give him the information he needs in a different way. Do you foresee the ability to drill-in from a "values" command coming through in a future splunk version?

Re: drilldown whilst using a search w stats values()

sideview — Wed, 19 May 2010 14:11:34 GMT

I think we'll get it fixed yea. It's not a hard thing to get right - i think we just overlooked it. I'll take a look and file it if it's not captured already. Thanks for the catch.