topic Re: How to hide the search string from end users on drilldown of graphs/charts? in Splunk Search

How to hide the search string from end users on drilldown of graphs/charts?

suryaavinash — Tue, 16 Feb 2016 17:07:54 GMT

I would like to hide the SPL search query when we drill down on a chart or a graph.

I tried MACRO's and saved searches, but didn't work out. Can you please help?

It is to not expose my query to the End users.

Re: How to hide the search string from end users on drilldown of graphs/charts?

somesoni2 — Tue, 16 Feb 2016 17:45:01 GMT

Could you explain more about your issue? Do you want to remove/hide the search string which is show in URL after drilldown? Providing your dashboard xml will help too.

Re: How to hide the search string from end users on drilldown of graphs/charts?

suryaavinash — Wed, 17 Feb 2016 05:32:38 GMT

I have created dashboards for users using splunk "dbquery" SPL command.

Ex: |dbquery "dbname" "select * from table1 where col1='xyz'" |stats count by col2

When User drills down , then i do not want him to view my query "select * from table1 where col1='xyz'".
Would like to understand how to hide the query from users view but allow him to drill down to see further results.

Re: How to hide the search string from end users on drilldown of graphs/charts?

somesoni2 — Wed, 17 Feb 2016 06:07:01 GMT

It will depending upon how you want to drilldown. For example (taking the query you gave as sample), the drilldown could be just to run another query based on col2. If that's the case, try something like this (run anywhere sample). In below example, all users would be able to see is sourcetype=ClickedValue

**All dashboard are created under "Search & Reporting" app.

Dashboard Name :thefirstdashboard

<dashboard>
  <label>thefirstdashboard</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count by sourcetype</query>
          <earliest>-4h@m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">10</option>
        <drilldown><link>/app/search/seconddashboard?sourcetype=$row.sourcetype$</link></drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Dashboard Name:seconddashboard

<dashboard>
  <label>seconddashboard</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=$sourcetype$| timechart count</query>
          <earliest>-4h@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">column</option>
      </chart>
    </panel>
  </row>
</dashboard>