Dashboards & Visualizations

drilldown does not work with "search base=" and query

luigialbino
Engager

I have a dashboard with many panel that use the same global search "my search_1", and each panel have an own query like " timechart count(field).." or "table field1".
When I click on a value on the chart, the drilldown give me all the output of global query "my_search1" missing the other part of query "timechart......" or "table fied1"
I look on the drilldown documentation but I don't found anything about the "search base=" o something like that.
Can anyone help me with this issue?

My_search1
.....

<query>

sourcetype="WinEventLog:Security" $field2$ EventCode="627" OR EventCode="628" OR EventCode="642" OR EventCode="644" OR EventCode="671" OR EventCode="685" OR EventCode="4723" OR EventCode="4724" OR EventCode="4738" OR EventCode="4740" OR EventCode="4767" OR EventCode="4781" OR EventCode="624" OR EventCode="626" OR EventCode="632" OR EventCode="636" OR EventCode="660" OR EventCode="4720" OR EventCode="4722 "OR EventCode="4728" OR EventCode="4732" OR EventCode="4756" OR EventCode="629" OR EventCode="630" OR EventCode="633" OR EventCode="634" OR EventCode="637" OR EventCode="638" OR EventCode="661" OR EventCode="662" OR EventCode="4725" OR EventCode="4726" OR EventCode="4729" OR EventCode="4730" OR EventCode="4733" OR EventCode="4734" OR EventCode="4757" OR EventCode="4758" OR EventCode="626" OR EventCode="4722" OR EventCode="629" OR EventCode="4725" OR EventCode="644" OR EventCode="4740" OR EventCode="671" OR EventCode="4767" $Business$| search NOT (Source_AccountName="*$" AND Target_AccountName="-")

..........

panel search
......

    <search base="my_search1">
      <query>|timechart  count(eval(EventCode="644" OR EventCode="4740")) AS acc_locked,count(eval(EventCode="671" OR EventCode="4767")) AS acc_unlocked</query>
    </search>

......

0 Karma
1 Solution

woodcock
Esteemed Legend

The best answer is to set your own manual drilldown and avoid the defaults. It is pretty easy. Download the V6 Visualizations app on splunkbase for many examples.

View solution in original post

0 Karma

woodcock
Esteemed Legend

The best answer is to set your own manual drilldown and avoid the defaults. It is pretty easy. Download the V6 Visualizations app on splunkbase for many examples.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...