Dashboards & Visualizations

dynamic token based drilldown in chart using a BY clause

JWBailey
Communicator

I have a timechart visualization using a by clause to display two different data sets. I think the number of successful logons and failed logons over time displayed on the same chart...

For example:

action=logon_failure  OR action=logon_success | timechart count by action

I want the timechart to have drilldown capability, so when someone clicks on a portion of the chart, a new panel displays the list of usernames that generate that value in the timechart.

I have no problems creating the "pop up" panel using the depends flag, and no problems setting tokens to grab the earliest and latest time values based on the user's click. But how do I capture which by clause attribute the user clicked? How do I pass the "logon_failure" or "logon_success" value so I can use it to filter the search results that drive the new panel?

Any guidance is appreciated. Thanks in advance.

~Wes

0 Karma
1 Solution

niketn
Legend

@JWBailey , if you have performed timechart by action you will have logon_failure and logon_success as columns which can be picked by using click.name2 predefined drilldown token. Please try the following and see if $tokAction$ picks the value you are interested in.

<drilldown>
    <set token="tokAction">$click.name2$</set>
</drilldown>

https://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#Drilldown_event_tokens

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@JWBailey , if you have performed timechart by action you will have logon_failure and logon_success as columns which can be picked by using click.name2 predefined drilldown token. Please try the following and see if $tokAction$ picks the value you are interested in.

<drilldown>
    <set token="tokAction">$click.name2$</set>
</drilldown>

https://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#Drilldown_event_tokens

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

JWBailey
Communicator

Worked like a charm, thank you. As is so often I was way over complicating it in my attempts.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...