How to drill down/ launch another search with parameter from results table in dashboard?

[nicolasperrenou]

Hi all. I have a advanced XML dashboard that shows me a table with some results from an web server access log search. When I click on a row, i want Splunk to open a new window and start a new search with a parameter from the search in the dashboard. More specifically, i want the new search to use the IP that I found in the base search and search in another type of log for that ip at the specific time. How can I achieve this (preferrably in a simple way)? This is mi first try, but the second search does not yet take the ip in consideration... Also the timerange needs to be changed, so that i find events that happen slightly before that log event. It would be cool if I simply could write something like

sourcetype="WebAuthLog" type="Login" ip=%ip% latest="%_time%" earliest="%_time%-1h"

So here is my code:

<view template="dashboard.html">
  <label>Test Dashboard</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="True">
    <param name="search">sourcetype="W3CAccessLogAdapter" method="POST" uri="/"</param>

      <module name="TimeRangePicker">
      <param name="searchWhenChanged">True</param>

      <module name="Paginator">
        <param name="entityName">events</param>
        <param name="count">50</param>

        <module name="SimpleResultsTable">
          <param name="displayRowNumbers">true</param>
          <param name="drilldown">row</param>
          <param name="entityName">events</param>
          <param name="fields">clientip, req_time</param>

          <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="True">
            <param name="search">sourcetype="WebAuthLog" type="Login" </param>

            <module name="ConvertToDrilldownSearch">
              <module name="ViewRedirector">
                <param name="viewTarget">flashtimeline</param>
                <param name="popup">true</param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>

Thanks and best regards

Nicolas

[thall79]

Have you tried creating another HiddenSearch module before your ViewRedirector. This should pass your click value down to that hidden search which will output to a new window with the view redirector.

For the time part need to play around a little.

travis.