Dashboards & Visualizations

Question about adding new time to search around events based on "parent"-search in sub/ child -search

lmyrefelt
Builder

Hi, I would like to know if it is possible to do the following;

I am trying to create a dashboard allowing our networking and help-desk team to search for user activity. They will first be presented with the option of the time frame to search for, after this they will have to put in a username or * to search for.

This will then give them back a table with username and some other fields. All the fields in this table is then selectable to do another search. However this sub-search returns all events that contains the selected field for the above selected time frame, lets say last 30 days.
However what i would like to do is to allow the people to select the username and time, for example 30 days to search for, than have them to select one of the fields from the results and do another search based on that field in a "new" with a new time set like 30 mins AROUND / or at least present me / us with the results 30 mins around this event from witch the field they chose existed. Not the whole 30days until now.

Did i make myself understandable ? 😛

The dashboard / searches ( interesting part ) comes here;

module name="Message" layoutPanel="messaging">
splunk.search.job
True
1


dashboard


index=blah user="$Username$" | table something, something, something
Network blah activity

<module name="TimeRangePicker">
    <param name="default">Last 15 minutes</param>
    <param name="searchWhenChanged">False</param>

  <module name="ExtendedFieldSearch">
    <param name="field">user</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
          <param name="Username">
              <param name="fillOnEmpty">True</param>
            <param name="value">*</param>
          </param>
      </param>
    </param>
    <param name="replacementMap">
      <param name="arg">
        <param name="Username">
            <param name="value">*</param>
        </param>
      </param>
    </param>

        <module name="HiddenSearch">
        <param name="search">index=proxy "$toreplace$"  </param>
                                    <module name="ConvertToIntention">
                                            <param name="settingToConvert">click.value2</param>
                                            <param name="intention">
                                                    <param name="name">stringreplace</param>
                                                    <param name="arg">
                                                            <param name="toreplace">
                                                                    <param name="value">$target$</param>
                                                            </param>
                                                    </param>
                                            </param>
                                            <module name="ViewRedirector">
                                                    <param name="viewTarget">flashtimeline</param>
                                            </module>
                                    </module>
                            </module>

        </module>
        <module name="ViewRedirectorLink">
          <param name="viewTarget">flashtimeline</param>

0 Karma

Lucas_K
Motivator

There is an existing thread here http://splunk-base.splunk.com/answers/58220/using-valuesetter-in-time-parameter that passes the existing time plus a relative time value to a click through search.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...