Dashboards & Visualizations

Question about adding new time to search around events based on "parent"-search in sub/ child -search

lmyrefelt
Builder

Hi, I would like to know if it is possible to do the following;

I am trying to create a dashboard allowing our networking and help-desk team to search for user activity. They will first be presented with the option of the time frame to search for, after this they will have to put in a username or * to search for.

This will then give them back a table with username and some other fields. All the fields in this table is then selectable to do another search. However this sub-search returns all events that contains the selected field for the above selected time frame, lets say last 30 days.
However what i would like to do is to allow the people to select the username and time, for example 30 days to search for, than have them to select one of the fields from the results and do another search based on that field in a "new" with a new time set like 30 mins AROUND / or at least present me / us with the results 30 mins around this event from witch the field they chose existed. Not the whole 30days until now.

Did i make myself understandable ? 😛

The dashboard / searches ( interesting part ) comes here;

module name="Message" layoutPanel="messaging">
splunk.search.job
True
1


dashboard


index=blah user="$Username$" | table something, something, something
Network blah activity

<module name="TimeRangePicker">
    <param name="default">Last 15 minutes</param>
    <param name="searchWhenChanged">False</param>

  <module name="ExtendedFieldSearch">
    <param name="field">user</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
          <param name="Username">
              <param name="fillOnEmpty">True</param>
            <param name="value">*</param>
          </param>
      </param>
    </param>
    <param name="replacementMap">
      <param name="arg">
        <param name="Username">
            <param name="value">*</param>
        </param>
      </param>
    </param>

        <module name="HiddenSearch">
        <param name="search">index=proxy "$toreplace$"  </param>
                                    <module name="ConvertToIntention">
                                            <param name="settingToConvert">click.value2</param>
                                            <param name="intention">
                                                    <param name="name">stringreplace</param>
                                                    <param name="arg">
                                                            <param name="toreplace">
                                                                    <param name="value">$target$</param>
                                                            </param>
                                                    </param>
                                            </param>
                                            <module name="ViewRedirector">
                                                    <param name="viewTarget">flashtimeline</param>
                                            </module>
                                    </module>
                            </module>

        </module>
        <module name="ViewRedirectorLink">
          <param name="viewTarget">flashtimeline</param>

0 Karma

Lucas_K
Motivator

There is an existing thread here http://splunk-base.splunk.com/answers/58220/using-valuesetter-in-time-parameter that passes the existing time plus a relative time value to a click through search.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...