Dashboards & Visualizations

Drilldown with same events- Having issues with panel2

lnn2204
Path Finder

Hi all,

I have 2 panels, I can call it like panel1 and panel2. The panel2 is detail of a value in panel1. And I didn't user post-process type. This is 2 individual panels.

The problem is the panel2 search different events, it missed the time to search. 

So how i fix it?

Panel1 with drilldown token ipDownload

 

 

 

<search>
<query>index=...
| fields SrcIP, DownSize
| chart sum(DownSize) as Download by SrcIP
| sort 10 -Download</query>
<earliest>$Time.earliest$</earliest>
<latest>$Time.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>

 

 

 

Panel2

 

 

 

<search>
          <query>index=...
| search SrcIP="$ipDownload$" 
| stats sum(DownSize) as Download by DstIP Client AppProtocol
| sort 10 -Size
| table DstIP, Client, AppProtocol, Download </query>
          <earliest>$Time.earliest$</earliest>
          <latest>$Time.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>

 

 

 

 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<panel>
  <chart>
	<title>Top Traffic - Download</title>
	<search>
          <done>
            <eval token="jobearly">$job.earliestTime$</eval>
            <eval token="joblate">$job.latestTime$</eval>
          </done>
	  <query>index=...
| fields SrcIP, DownSize
| chart sum(DownSize) as Download by SrcIP
| sort 10 -Download</query>
	  <earliest>$TimeOfTraffic.earliest$</earliest>
	  <latest>$TimeOfTraffic.latest$</latest>
	  <sampleRatio>1</sampleRatio>
	</search>
	<drilldown>
	  <set token="showDownloadDetail">true</set>
	  <set token="ipDownload">$click.value$</set>
          <eval token="early">$jobearly$</eval>
          <eval token="late">$joblate$</eval>
	</drilldown>
  </chart>
</panel>
<row depends="$showDownloadDetail$">
    <panel>
      <table depends="$ipDownload$">
        <title>Top Host Download from $ipDownload$</title>
        <search>
          <query>index=... earliest=$early$ latest=$late$
| search SrcIP="$ipDownload$" 
| stats sum(DownSize) as Download by DstIP Client AppProtocol
| sort 10 -Size
| table DstIP, Client, AppProtocol, Download </query>
          <earliest>$TimeOfTraffic.earliest$</earliest>
          <latest>$TimeOfTraffic.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like both panels are using the same time ($Time.earliest$ and $Time.latest$)

Are you wanting to use something from the row that is clicked in the first panel to modify the search in the second panel?

You can do this by adding a drilldown, setting some tokens, and use these tokens in the second search

0 Karma

lnn2204
Path Finder

I mean when i finished panel1. I click a value on that, then the panel2 will search for that value. In this case is $ipDownload$ , but it search with another time. The output is quite difference.

panel1 took 10mins to finish, so when panel2 start, it’s 10mins later. Any suggestions please..

Thanks for reading my stupid grammar. 🥲

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share your drilldown code?

0 Karma

lnn2204
Path Finder

Sure. Here it is

Panel1

<panel>
  <chart>
	<title>Top Traffic - Download</title>
	<search>
	  <query>index=...
| fields SrcIP, DownSize
| chart sum(DownSize) as Download by SrcIP
| sort 10 -Download</query>
	  <earliest>$TimeOfTraffic.earliest$</earliest>
	  <latest>$TimeOfTraffic.latest$</latest>
	  <sampleRatio>1</sampleRatio>
	</search>
	<drilldown>
	  <set token="showDownloadDetail">true</set>
	  <set token="ipDownload">$click.value$</set>
	</drilldown>
  </chart>
</panel>

Panel2

<row depends="$showDownloadDetail$">
    <panel>
      <table depends="$ipDownload$">
        <title>Top Host Download from $ipDownload$</title>
        <search>
          <query>index=... 
| search SrcIP="$ipDownload$" 
| stats sum(DownSize) as Download by DstIP Client AppProtocol
| sort 10 -Size
| table DstIP, Client, AppProtocol, Download </query>
          <earliest>$TimeOfTraffic.earliest$</earliest>
          <latest>$TimeOfTraffic.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<panel>
  <chart>
	<title>Top Traffic - Download</title>
	<search>
          <done>
            <eval token="jobearly">$job.earliestTime$</eval>
            <eval token="joblate">$job.latestTime$</eval>
          </done>
	  <query>index=...
| fields SrcIP, DownSize
| chart sum(DownSize) as Download by SrcIP
| sort 10 -Download</query>
	  <earliest>$TimeOfTraffic.earliest$</earliest>
	  <latest>$TimeOfTraffic.latest$</latest>
	  <sampleRatio>1</sampleRatio>
	</search>
	<drilldown>
	  <set token="showDownloadDetail">true</set>
	  <set token="ipDownload">$click.value$</set>
          <eval token="early">$jobearly$</eval>
          <eval token="late">$joblate$</eval>
	</drilldown>
  </chart>
</panel>
<row depends="$showDownloadDetail$">
    <panel>
      <table depends="$ipDownload$">
        <title>Top Host Download from $ipDownload$</title>
        <search>
          <query>index=... earliest=$early$ latest=$late$
| search SrcIP="$ipDownload$" 
| stats sum(DownSize) as Download by DstIP Client AppProtocol
| sort 10 -Size
| table DstIP, Client, AppProtocol, Download </query>
          <earliest>$TimeOfTraffic.earliest$</earliest>
          <latest>$TimeOfTraffic.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
0 Karma

lnn2204
Path Finder

It didn't work, but I tried with 

 

<row depends="$showDownloadDetail$">
    <panel>
      <table depends="$ipDownload$">
        <title>Top Host Download from $ipDownload$</title>
        <search>
          <query>index=...
| search SrcIP="$ipDownload$" 
| stats sum(DownSize) as Download by DstIP Client AppProtocol
| sort 10 -Size
| table DstIP, Client, AppProtocol, Download </query>
          <earliest>$early$</earliest>
          <latest>$late$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>

 

So it worked perfectly. And we can remove the <eval> in drilldown, then call the token directly from <done>.

By the way, i don't know how to find something like <done> tag, could you send me some docs about this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...