Dashboards & Visualizations

point to events for aggregate functions

pratibha2018
Explorer

Hi ,

So, I have a dashboard containing search query like :

search query | stats max(field1) by field2

but when I want to see the events for a particular point it leads me to all results for field1 rather than the showing events for field1= max(field1) and field2=result2(selected point for).

Any suggestions, please?

0 Karma
1 Solution

niketn
Legend

Try the following Run anywhere dashboard example based on Splunk's _internal index. It passes on the value of max(date_seconds) to a new search (using predefined drilldown token $click.value2$) which opens in new window.

<form>
  <label>Max Field Value for Drilldown</label>
  <fieldset submitButton="false">
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats max(date_second) as date_second by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">search?q=index=_internal sourcetype=splunkd log_level=* date_second="$click.value2$"&amp;earliest=$tokTime.earliest$&amp;latest=$tokTime.latest$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Try the following Run anywhere dashboard example based on Splunk's _internal index. It passes on the value of max(date_seconds) to a new search (using predefined drilldown token $click.value2$) which opens in new window.

<form>
  <label>Max Field Value for Drilldown</label>
  <fieldset submitButton="false">
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats max(date_second) as date_second by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">search?q=index=_internal sourcetype=splunkd log_level=* date_second="$click.value2$"&amp;earliest=$tokTime.earliest$&amp;latest=$tokTime.latest$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

pratibha2018
Explorer

This works.

Thanks, @niketnilay!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...