topic Re: Search cluster operator drill down issue in Splunk Search

Search cluster operator drill down issue

liyiou — Mon, 19 Aug 2013 17:26:19 GMT

I searched the error events and use the "cluster" operator as below:

error | cluster | table cluster_count _raw

I got a list of clusters with the size of each cluster as below:

1   98  192.168.11.37 - - ..." 2899 4035
2   4   Apr 13 15:03:10 1.1.1.1 ... (2006-04-13 15:02:40)<000>
3   12  Jan 14 09:47:14 ...(2005-01-14 09:48:21)
...

Now I click the cluster size (98) to look for the 98 events in that cluster, however, there is only one event displayed. Is there anything I did wrong?

Re: Search cluster operator drill down issue

cpeteman — Mon, 19 Aug 2013 17:39:11 GMT

can you post the drill down search?

Re: Search cluster operator drill down issue

liyiou — Mon, 19 Aug 2013 21:59:41 GMT

error | cluster | table cluster_count _raw

The above is my input for search and cluster. By "drilldown" I mean I click the link on the cluster size to further display cluster details -- I always see one event no matter which cluster I click. I just wonder what this event mean? --- a sample event from the cluster?

Re: Search cluster operator drill down issue

cpeteman — Mon, 19 Aug 2013 22:06:15 GMT

In my version of Splunk when I click on information like that the "drilldown" opens a new Splunk window with the drilldown search at the top. stuff like

search term | stats count by ip | sort -count

when I click on "192.168.84.2" a new widow opens with the search:

search terms ip="192.168.84.2"

Re: Search cluster operator drill down issue

khourihan_splun — Tue, 14 Oct 2014 17:10:03 GMT

Hi, I know is years later, but I have your answer ! You need to add the labelonly=t to your cluster command.

error | cluster labelonly=t showcount=t  | table cluster_count, cluster_label, _raw | sort - cluster_count

You can drill into the cluster label to get all your results.

then you get the 15 results: