Dashboards & Visualizations

Can you help me on a drilldown parameter please?

jip31
Motivator

hello

From the report below, I want to do a drilldown by Mois (which is the month)

index="ai-wkst-wineventlog-fr" sourcetype=XmlWinEventLog source="XmlWinEventLog:System" EventCode=11 Level=2 Name='Disk'  Mois="$process$" | eval Mois=strftime(_time,"%Y-%m") 
  | dedup _time
| table _time host Type EventCode Mois

in the explorer editor I putted : form.process = $row.Mois$

and in the drilldown report I putted:

index="ai-wkst-wineventlog-fr" sourcetype=XmlWinEventLog source="XmlWinEventLog:System" EventCode=11 Level=2 Name='Disk'  Mois="$process$" | eval Mois=strftime(_time,"%Y-%m")
  | dedup _time
| table _time host Type EventCode

But I have no results
could you help me please??

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your initial search is overriding Mois with a year-month string - it's quite possible that your raw data doesn't actually look like that. Hard to be sure though without knowing your data.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Your initial search is overriding Mois with a year-month string - it's quite possible that your raw data doesn't actually look like that. Hard to be sure though without knowing your data.

0 Karma

Vijeta
Influencer

what is the query you are using for populating the process token?

0 Karma

jip31
Motivator

hi
| loadjob savedsearch="admin:FO_DiskHealth_Monitoring:FO_DiskHealth_EV"
| search host=$tok_filterhost$
| fields - host

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...