Splunk Enterprise Security

In Splunk Enterprise Security, how do you change a query result when a drop down option is selected within a panel?

bhaskarasplunk
Explorer

Hi,

I have four options in a drop down--- Highest,Lowest ,Top 5 and Least 5.

Each option has a query:

For example : 'Highest' is based on the query:

index=_internal idx=* source=*license_usage.log type=Usage |  eval totalMB = b/1024/1024  | eval totalGB = totalMB /1024 | rename idx as Index | stats sum(totalGB) by Index|rename sum(totalGB) as "License Usage"|sort -"License Usage"|head 1

For example : 'Top 5' is based on the query:

index=_internal idx="*" source=*license_usage.log type=Usage |  eval totalMB = b/1024/1024  | eval totalGB = totalMB /1024 
| rename idx as Index |stats sum(totalGB) as LicenseUsage by Index |where LicenseUsage >5|sort -LicenseUsage

So, if I select the one option, the results of that particular option and query should come on the panel.

Can you please help me with the code as I have a problem building the exact code to link each search with the associated drop down option.

Thanks,

Bhaskar

0 Karma

lakshman239
SplunkTrust
SplunkTrust

yes, you need to capture the selected value on to a token, which you can use later.

Also, as your search seems to be common, suggest, you use base and post-process search.

your base search can be

index=_internal idx="*" source=*license_usage.log type=Usage | eval totalMB = b/1024/1024 | eval totalGB = totalMB /1024
| rename idx as Index |stats sum(totalGB) as LicenseUsage by Index

Then in the post process search, you can use the token

 where LicenseUsage > $token_value$

https://docs.splunk.com/Documentation/Splunk/7.2.4/Viz/Savedsearches

0 Karma

Vijeta
Influencer

@bhaskarasplunk for each value you need to set a token. for example if your drilldown value is highest set the token highest to 1, of value is lowest , set a token name it lowest to 1 and similarly for Top 5 and least 5

<change>
  <condition value="Highest">
    <set token="Highest">1</set>
    <unset token="lowest"></unset>
    <unset token="least5"></unset>
    <unset token="top5"></unset>
 <condition value="lowest">
    <unset token="Highest"></unset>
    <set token="lowest">1</set>
    <unset token="least5"></unset>
    <unset token="top5"></unset>
----
----
</condition>
</change>

. For each query use depends for example for query for highest..use <search depends=$Highest$>

0 Karma
Get Updates on the Splunk Community!

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...