Drill Down Search

kjain041523 — Thu, 18 Jun 2026 19:35:00 GMT

drilldown search in splunk notable is not capturing the original host which is mentioned in correlation search and generating 0 results how to resolve this issue.

Correlation Search:

index=wineventlog host IN (AZR01PSQL19CL01, AZR01PSQL19CL02)
(EventCode=1069 OR EventCode=1205 OR EventCode=1641 OR EventCode=1480)
| eval usecase=" SQL 2019 Cluster Failover"
| stats count min(_time) as firstTime max(_time) as lastTime by host EventCode Message
| eval severity=case (
EventCode=1205 OR EventCode=1480, "critical", EventCode=1069, "high", EventCode=1641, "medium"
)
| convert ctime(firstTime) ctime(lastTime)

Drilldown search
index=wineventlog host=$Host$
(EventCode=1069 OR EventCode=1205 OR EventCode=1641 OR EventCode=1480)
| eval usecase=" SQL 2019 Cluster Failover"
| stats count min(_time) as firstTime max(_time) as lastTime by host EventCode Message
| eval severity=case (
EventCode=1205 OR EventCode=1480, "critical", EventCode=1069, "high", EventCode=1641, "medium"
)
| convert ctime(firstTime) ctime(lastTime)

when checking the drilldown search from splunk notable, i'm not getting any results and showing below code
index=wineventlog host=aws01psplksh01
(EventCode=1069 OR EventCode=1205 OR EventCode=1641 OR EventCode=1480)
| eval usecase=" SQL 2019 Cluster Failover"
| stats count min(_time) as firstTime max(_time) as lastTime by host EventCode Message
| eval severity=case (
EventCode=1205 OR EventCode=1480, "critical", EventCode=1069, "high", EventCode=1641, "medium"
)
| convert ctime(firstTime) ctime(lastTime)

How to resolve this issue.
TIA

Re: Drill Down Search

richgalloway — Thu, 18 Jun 2026 20:37:02 GMT

This probably should go in the Enterprise Security channel, but it looks like the drilldown search is using token $Host$, which doesn't exist. Try $host$.

Re: Drill Down Search

gcusello — Fri, 19 Jun 2026 06:58:20 GMT

Hi @kjain041523 ,

you must use as token the same field name of the Detection search, in yur case $host$ and not $Host$.

Ciao.

Giuseppe

topic Re: Drill Down Search in Splunk Search

Drill Down Search

Re: Drill Down Search

Re: Drill Down Search