Splunk Enterprise Security

How to make cluster map drilldown link to related search?

New Member
            <title>Registered Devices (Map)</title>
                <query>| devicesearch query="$sensor_search$" | spath | where status="REGISTERED" | iplocation
                    lastExternalIpAddress | geostats latfield=lat longfield=lon count by lastExternalIpAddress
            <option name="mapping.drilldown">none</option>
            <option name="mapping.type">marker</option>
            <option name="refresh.display">progressbar</option>

I have a panel in a dashboard as shown, I need to fix the drilldowns so that they link to the configured search w/ the relevant ranges for LAT/LONG pairs. I seem to be able to make this quasi-work, by enabling all drilldowns - I would like the map to not zoom as a drilldown, but instead just link to the search.

I have looked at the relevant documentation but can't make heads or tails of it. Other than all/none for drilldown options, or specifying the link and the search explicitly - is there an option to only do the link to search drilldown?


0 Karma