Splunk Enterprise Security

How to make cluster map drilldown link to related search?

New Member
            <title>Registered Devices (Map)</title>
            <search>
                <query>| devicesearch query="$sensor_search$" | spath | where status="REGISTERED" | iplocation
                    lastExternalIpAddress | geostats latfield=lat longfield=lon count by lastExternalIpAddress
                </query>
                <earliest>0</earliest>
                <latest></latest>
            </search>
            <option name="mapping.drilldown">none</option>
            <option name="mapping.type">marker</option>
            <option name="refresh.display">progressbar</option>
        </map>

I have a panel in a dashboard as shown, I need to fix the drilldowns so that they link to the configured search w/ the relevant ranges for LAT/LONG pairs. I seem to be able to make this quasi-work, by enabling all drilldowns - I would like the map to not zoom as a drilldown, but instead just link to the search.

I have looked at the relevant documentation but can't make heads or tails of it. Other than all/none for drilldown options, or specifying the link and the search explicitly - is there an option to only do the link to search drilldown?

V/r,
ZE

0 Karma