Creating a report that progressively narrows the data set

[amanteja]

Imagine that we are sending data that has the following fields in every event
time, userid, thread ...

Would like to create a forms where the on call engineer can

1. Start by selecting a time range
2. He/she is now able to view all the user ids in that time range in a drop down
3. Now the engineer can select a user. On doing that the engineer is able to view the list of all the thread ids that this user has made requests in the given time period (again a dropdown)
4. And so on...

To finally arrive at a small subset of logs that he/she should inspect. Is this doable? Could you point me to a sample?

[martin_mueller]

That's doable.

In short, this could be an approach:

1. time range picker
2. feed time range into a search for user ids, populating a pulldown
3. feed time range and user id into a search for thread ids, populating a pulldown
4. and so on
5. feed all params to the final search, yielding your desired events

Depending on your data, it's probably smart to have commonly used fields filled from prepared lookups to speed things up.

[martin_mueller]

I had something a little different in mind - one Advanced XML view with a tree of pulldowns. A bit like the SideviewUtils doc on "Pulldown - reusing searches with 'postProcess'", available under Key Techniques if you have Sideview Utils v2 (get it from http://sideviewapps.com/apps/sideview-utils/ - you really should!).

[amanteja]

Thanks.
In the second form- as soon as the user has picked a userid (prepopulated by query) how does one transition to the next form WITHOUT showing the results to the user and having him click on that as documented here http://docs.splunk.com/Documentation/Splunk/5.0.3/Viz/Dynamicdrilldownindashboardsandforms#Dynamic_d...