Dashboards & Visualizations

Question about adding new time to search around events based on "parent"-search in sub/ child -search

lmyrefelt
Builder

Hi, I would like to know if it is possible to do the following;

I am trying to create a dashboard allowing our networking and help-desk team to search for user activity. They will first be presented with the option of the time frame to search for, after this they will have to put in a username or * to search for.

This will then give them back a table with username and some other fields. All the fields in this table is then selectable to do another search. However this sub-search returns all events that contains the selected field for the above selected time frame, lets say last 30 days.
However what i would like to do is to allow the people to select the username and time, for example 30 days to search for, than have them to select one of the fields from the results and do another search based on that field in a "new" with a new time set like 30 mins AROUND / or at least present me / us with the results 30 mins around this event from witch the field they chose existed. Not the whole 30days until now.

Did i make myself understandable ? 😛

The dashboard / searches ( interesting part ) comes here;

module name="Message" layoutPanel="messaging">
splunk.search.job
True
1


dashboard


index=blah user="$Username$" | table something, something, something
Network blah activity

<module name="TimeRangePicker">
    <param name="default">Last 15 minutes</param>
    <param name="searchWhenChanged">False</param>

  <module name="ExtendedFieldSearch">
    <param name="field">user</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
          <param name="Username">
              <param name="fillOnEmpty">True</param>
            <param name="value">*</param>
          </param>
      </param>
    </param>
    <param name="replacementMap">
      <param name="arg">
        <param name="Username">
            <param name="value">*</param>
        </param>
      </param>
    </param>

        <module name="HiddenSearch">
        <param name="search">index=proxy "$toreplace$"  </param>
                                    <module name="ConvertToIntention">
                                            <param name="settingToConvert">click.value2</param>
                                            <param name="intention">
                                                    <param name="name">stringreplace</param>
                                                    <param name="arg">
                                                            <param name="toreplace">
                                                                    <param name="value">$target$</param>
                                                            </param>
                                                    </param>
                                            </param>
                                            <module name="ViewRedirector">
                                                    <param name="viewTarget">flashtimeline</param>
                                            </module>
                                    </module>
                            </module>

        </module>
        <module name="ViewRedirectorLink">
          <param name="viewTarget">flashtimeline</param>

0 Karma

Lucas_K
Motivator

There is an existing thread here http://splunk-base.splunk.com/answers/58220/using-valuesetter-in-time-parameter that passes the existing time plus a relative time value to a click through search.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...