Dashboards & Visualizations

How to pull the query out of a savedsearch?


I have a savedsearch file with all of my alerts. I want to be able to pull the entire query into a Splunk search when I click a stats table row that is displaying information about the search

index="nitro_prod_splunk_application_summary" earliest=-1h@m latest=@m [| `nitro_prod_service_app_relationships` | search Category="*" Service="*" Application="*"  | stats count by Application | table Application] | join Application [ | `nitro_prod_cmdb_service_app_relationships` ] | search Alert_Type="*" Metric_Category="*" | eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | sort +Alert

Which creates a table that looks like this sort of:
alt text

Any ideas on how I would drilldown and be able to search the query behind what is being displayed?

0 Karma

Revered Legend

Which column is the saved search/alert name? You can drilldown to a panel with following search

| savedsearch $drilldownTokenForColumnWhichContainsAlertName$
0 Karma


This should help get you started. Based on user selected value, set a token to represent the full search string -->

    <label>test search swapper</label>
    <fieldset submitButton="false">
      <input type="time" token="field1">
        <condition label="All time">
          <set token="new_search">`set_sos_index` sourcetype="ps" $host$
            | multikv
            | `get_splunk_process_type`
            | eval RSZ_MB=RSZ_KB/1024
            | eval VSZ_MB=VSZ_KB/1024
            | bin _time span=5s
            | stats first(pctCPU) AS pctCPU, first(RSZ_MB) AS RSZ_MB, first(VSZ_MB) AS VSZ_MB first(type) AS type by PID _time
            | stats sum(pctCPU) AS pctCPU, sum(RSZ_MB) AS RSZ_MB, sum(VSZ_MB) AS VSZ_MB by type, _time
            | bin _time span=10s
            | sistats avg(pctCPU), median(pctCPU), median(RSZ_MB), median(VSZ_MB) by type, _time</set>
        <condition label="Last 24 hours">
          <set token="new_search">index=_internal sourcetype=splunkd | table _time sourcetype message</set>
        <condition value="*">
          <set token="new_search">index=_internal sourcetype=splunkd | table _time source sourcetype message</set>
0 Karma


Here is another one

 <!-- Begin the conditional drill down -->
          <condition field="MSO - Click for Expanded View">
            <set token="tablevariablesubscribers">$click.value2$</set>
            <eval token="s_mso_s">case($click.value2$="Cox Home Life - CHL", "Cox", $click.value2$="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
          <condition field="*">
            <unset token="tablevariablesubscribers"></unset>

        <!-- End the conditional drill down -->
0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...