Dashboards & Visualizations

Drilldown set form parameters and search again

Hi All,

I am trying to work out if this is even possible with drilldowns and forms.

At the end of this post is a very simple form which searches an apache logfile and generates a table of all clientIP addresses. I understand the form is useless as it will cause the table to only show one result. I have just dumbed it down so I can get an answer to the question.

The form allows the user to enter an IP address to restrict by which is then passed onto the search.

Question: Is there a way to setup a drilldown on the table whereby when the user clicks on an IP address it is populated to the form field and the search is performed again?

I have looked through all the advanced XML queries and demos but I cant seem to find one that behaves in this manner. Is it even possible?

    <form class="formsearch">
    <label>Client Details</label>

        <input type="text" token="clientIP" searchWhenChanged="false">
    <input type="time" searchWhenChanged="false"/>

            <title>Top client IP addresses</title>
            <searchTemplate>index=webserver (sourcetype=access_combined OR sourcetype=vhost_access_combined) clientip="$clientIP$" | top limit=10 clientip</searchTemplate>
Tags (1)
0 Karma


There was a very similar question recently and I advised the asker to download Sideview Utils and check out how it's done using those modules to augment the core Splunk modules. This is a pretty core use case of Sideview Utils, and the ability to drilldown and prepopulate elements in form search views is one of the main reasons I created the framework.


0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!