How to create a drilldown where a value clicked in a table is passed to a search string that populates other dashboard panels?

[cgekoski]

I have been searching with no luck, probably because i do not know exactly how to phrase the question. I basically have a search looking against our firewall logs for outbound destination mail ports; 25, 110,143,993,etc. then piped to a chart count by source ip and destination port and it generates a stats panel with the source ip first, then each port respectively across the rows.

What i want to be able to do then is have a search field box on the dashboard that when i click an IP from the columns it places it inside the field, which then starts populating other panels within my dashboard. Right now i have it to where i have to manually type in the IP into the field, Not a big deal but wanted the ease of clicking for other admins and help desk techs.

right now my other panels in the dashboard have a search string with the extra piece of src_ip="$field1$" within the search string.

Also FYI, very fresh with splunk so please answer in lamans terms if possible

Thanks,

Cory

[satishsdange]

Hi Cory -
Dymanic drilldown can address your requirements. Please refer to below links -
http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/tokens#Define_tokens_for_dynamic_drilldown
http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/Dynamicdrilldownindashboardsandforms

[ramdaspr]

You have most of the solution already implemented. Whats left is to define a token called $field1$ on the chart using the drilldown tag. You can look through the examples and details on the docs.

Set the Search field box token name to $field1$ so that it auto populates when you click on the chart and you already have the other panels updated to include the token so they will fire only when an ip is selected on the chart.