Dashboards & Visualizations

Drill down on dashboard is showing large search

Path Finder

I have a few dashboards that display different information about top browsers. I have created a

| replace "long string here" with "user friendly here" in cs_User_Agent

in the search on each dashboard that replaces the IIS log cs_User_Agent value with something more understandable for the user. This replace has grown larger and larger with all the different cs_User_Agent values generated by the IIS logs. When the user clicks to drill down on one of the values on the browser dashboards it takes them to the event tab. The search is displayed and the search is very large. Is there a way to not have the search field expanded when they drill down?

Tags (3)
0 Karma


You could create a CSV file for all the information that you're putting in the replace phrase, and then use it as the basis of a static lookup. I followed these instructions and they worked like a charm:


Once you've done that, your drilldowns should become more coherent since they'll be working on the new field with the friendly name, and all the information currently in the replace phrase won't need to be in the search proper.


You can define your custom drilldowns.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...