Dashboards & Visualizations

Can't unset drilldown token in viz

mmcg
Explorer

Hi,

First time poster here been lurking for too long and I just can't seem to understand where I am going wrong here...

I have created a cluster map that displays the frequency of observed comms with 'bad IPs' . I want to to run a search that will return any IPs that have communicated with the selected bad ip on click, however I'm having an issue unsetting the token for a drilldown, although I am not getting any errors in the XML. It is constantly set at the first value I ever clicked on.

Can anyone see any errors related to the unset in my XML?

Thanks for your help in advance.

<dashboard>
  <label>Bad IPs</label>
  <row>
    <panel>
      <title>Blacklisted IPs Observed</title>
      <map>
        <search>
          <query>| tstats summariesonly=t count FROM datamodel=Network_Traffic.All_Traffic GROUPBY All_Traffic.src_ip 
| rename All_Traffic.src_ip as HostAddress 
| lookup bad_ip.csv HostAddress OUTPUT HostAddress as ip 
| search ip=*
| append 
    [| tstats summariesonly=t count FROM datamodel=Network_Traffic.All_Traffic GROUPBY All_Traffic.dest_ip 
| rename All_Traffic.dest_ip as HostAddress 
| lookup bad_ip.csv HostAddress OUTPUT HostAddress as ip 
| search ip=*]
    | iplocation ip
    | geostats globallimit=0 count by ip</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="mapping.type">marker</option>
        <drilldown>
          <set token="ip_token">$click.name$</set>
          <link target="_blank">search?q=| datamodel Network_Traffic All_Traffic search| search All_Traffic.src_ip=$ip_token|s$ OR All_Traffic.dest_ip=$ip_token|s$
| table All_Traffic.src_ip ,All_Traffic.dest_ip 
| rename All_Traffic.src_ip as Source, All_Traffic.dest_ip as dest_ip 
| stats values(dest_ip) as "Destination" by Source&amp;earliest=-24h@h&amp;latest=now
          <unset token="ip_token"></unset>
        </drilldown>
      </map>
    </panel>
</dashboard>
0 Karma

niketn
Legend

If your purpose is to get the token from drilldown and use it as a Search input in new link, you need not set and unset token. You can directly use default drilldown token i.e. $click.name$ in the <link>

         <drilldown>
           <link target="_blank">search?q=| datamodel Network_Traffic All_Traffic search| search All_Traffic.src_ip=$click.name|s$ OR All_Traffic.dest_ip=$click.name|s$
 | table All_Traffic.src_ip ,All_Traffic.dest_ip
 | rename All_Traffic.src_ip as Source, All_Traffic.dest_ip as dest_ip
 | stats values(dest_ip) as "Destination" by Source&amp;earliest=-24h@h&amp;latest=now
         </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mmcg
Explorer

My mistake I should not have been using $click.name$ as it constantly uses the first field, I had to rewrite my base search.

0 Karma

niketn
Legend

I think it should be $click.value$ not $click.name$. If you can sample the output of the final table used to plot map, we would be able to confirm the exact default token for the map drilldown.

If you want to figure out on your own, you can refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#map_.28event_tokens.29

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mmcg
Explorer

geobin - Lat - Long - IP1 - IP2 - so on
value - laval - lonval - countval - countval

The problem is that whether I use click.value or click.name it always defaults to the first value (i.e IP1.count or IP1.

It appears to be a limitation of geostats, as I would really have expected to get this working in Splunk.

However I'm open to suggestions.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...