Dashboards & Visualizations

point to events for aggregate functions

Explorer

Hi ,

So, I have a dashboard containing search query like :

search query | stats max(field1) by field2

but when I want to see the events for a particular point it leads me to all results for field1 rather than the showing events for field1= max(field1) and field2=result2(selected point for).

Any suggestions, please?

0 Karma
1 Solution

Legend

Try the following Run anywhere dashboard example based on Splunk's _internal index. It passes on the value of max(date_seconds) to a new search (using predefined drilldown token $click.value2$) which opens in new window.

<form>
  <label>Max Field Value for Drilldown</label>
  <fieldset submitButton="false">
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats max(date_second) as date_second by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">search?q=index=_internal sourcetype=splunkd log_level=* date_second="$click.value2$"&amp;earliest=$tokTime.earliest$&amp;latest=$tokTime.latest$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Legend

Try the following Run anywhere dashboard example based on Splunk's _internal index. It passes on the value of max(date_seconds) to a new search (using predefined drilldown token $click.value2$) which opens in new window.

<form>
  <label>Max Field Value for Drilldown</label>
  <fieldset submitButton="false">
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats max(date_second) as date_second by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">search?q=index=_internal sourcetype=splunkd log_level=* date_second="$click.value2$"&amp;earliest=$tokTime.earliest$&amp;latest=$tokTime.latest$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Explorer

This works.

Thanks, @niketnilay!

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!