Dashboards & Visualizations

point to events for aggregate functions

pratibha2018
Explorer

Hi ,

So, I have a dashboard containing search query like :

search query | stats max(field1) by field2

but when I want to see the events for a particular point it leads me to all results for field1 rather than the showing events for field1= max(field1) and field2=result2(selected point for).

Any suggestions, please?

0 Karma
1 Solution

niketn
Legend

Try the following Run anywhere dashboard example based on Splunk's _internal index. It passes on the value of max(date_seconds) to a new search (using predefined drilldown token $click.value2$) which opens in new window.

<form>
  <label>Max Field Value for Drilldown</label>
  <fieldset submitButton="false">
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats max(date_second) as date_second by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">search?q=index=_internal sourcetype=splunkd log_level=* date_second="$click.value2$"&amp;earliest=$tokTime.earliest$&amp;latest=$tokTime.latest$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Try the following Run anywhere dashboard example based on Splunk's _internal index. It passes on the value of max(date_seconds) to a new search (using predefined drilldown token $click.value2$) which opens in new window.

<form>
  <label>Max Field Value for Drilldown</label>
  <fieldset submitButton="false">
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats max(date_second) as date_second by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">search?q=index=_internal sourcetype=splunkd log_level=* date_second="$click.value2$"&amp;earliest=$tokTime.earliest$&amp;latest=$tokTime.latest$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

pratibha2018
Explorer

This works.

Thanks, @niketnilay!

Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...