Dashboards & Visualizations

<driildown_search> search query for <drilldown_name>="View all login attempts by system $src$"

Mahalaxmi
Loves-to-Learn

Hello ,

I need to frame the search query for <drilldown_search> for the following type :

"drilldown_search": "| from datamodel:\"Authentication\".\"Authentication\" | search src=$src|s$"

Currently in my results have value for src, how Do I escape this '|s' in the query string.

 

Thanks,

Mahalaxmi 

 

Labels (1)
Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Mahalaxmi 

Can you please share more details like, sample code block, use case , etc ??

KV

0 Karma

Mahalaxmi
Loves-to-Learn

Hello @kamlesh_vaghela 
Use Case:
The current requirement is to fetch the base events from Contributing events for a Notable event using Splunk Search Rest API. Reference https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/RESTREF/RESTsearch#search.2Fjobs

As part of the Post Search action, we have rule_id & timestamp. in response <sid>(Search ID) is returned . With help of this <sid>  <drilldown> parameteres. like <drilldown_name>,<drilldown_latest>,<drilldown_earliest>,<drilldown_search> & <src> fields  we need to make search query.

My question is based on these drilldown parameters how do I make the search query for fetching the base events using  <drilldown_search>?
"drilldown_search": "| from datamodel:\"Authentication\".\"Authentication\" | search src=$src|s$"


This is API URL for post action:
https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/RESTREF/RESTsearch#search.2Fjobs

https://<host>:<mPort>/services/search/jobs

 Where and all fields do I need to replace the  '$src$' value and frame the query?

 

Thanks,
Mahalaxmi 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you pleas share code block of this?

"drilldown_search": "| from datamodel:\"Authentication\".\"Authentication\" | search src=$src|s$"

 

0 Karma

Mahalaxmi
Loves-to-Learn

Hello 

I doing this in Postman, passing data search value by substituting the src value as request param

| from datamodel:\"Authentication\".\"Authentication\" | search src="NAOBDSADDC01"

for single value of src.

 

 

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...