Dashboards & Visualizations

Drill down on dashboard is showing large search

Path Finder

I have a few dashboards that display different information about top browsers. I have created a

| replace "long string here" with "user friendly here" in csUserAgent

in the search on each dashboard that replaces the IIS log csUserAgent value with something more understandable for the user. This replace has grown larger and larger with all the different csUserAgent values generated by the IIS logs. When the user clicks to drill down on one of the values on the browser dashboards it takes them to the event tab. The search is displayed and the search is very large. Is there a way to not have the search field expanded when they drill down?

Tags (3)
0 Karma

Motivator

You could create a CSV file for all the information that you're putting in the replace phrase, and then use it as the basis of a static lookup. I followed these instructions and they worked like a charm:

http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Addfieldsfromexternaldatasources

Once you've done that, your drilldowns should become more coherent since they'll be working on the new field with the friendly name, and all the information currently in the replace phrase won't need to be in the search proper.

SplunkTrust
SplunkTrust

You can define your custom drilldowns.

0 Karma