Dashboards & Visualizations

How to create a drilldown where a value clicked in a table is passed to a search string that populates other dashboard panels?

cgekoski
Path Finder

I have been searching with no luck, probably because i do not know exactly how to phrase the question. I basically have a search looking against our firewall logs for outbound destination mail ports; 25, 110,143,993,etc. then piped to a chart count by source ip and destination port and it generates a stats panel with the source ip first, then each port respectively across the rows.

What i want to be able to do then is have a search field box on the dashboard that when i click an IP from the columns it places it inside the field, which then starts populating other panels within my dashboard. Right now i have it to where i have to manually type in the IP into the field, Not a big deal but wanted the ease of clicking for other admins and help desk techs.

right now my other panels in the dashboard have a search string with the extra piece of src_ip="$field1$" within the search string.

Also FYI, very fresh with splunk so please answer in lamans terms if possible

Thanks,

Cory

0 Karma

satishsdange
Builder

ramdaspr
Contributor

You have most of the solution already implemented. Whats left is to define a token called $field1$ on the chart using the drilldown tag. You can look through the examples and details on the docs.

Set the Search field box token name to $field1$ so that it auto populates when you click on the chart and you already have the other panels updated to include the token so they will fire only when an ip is selected on the chart.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...

Index This | How many sevens are there between 1 and 100?

August 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...