Splunk Search

How to hide the search string from end users on drilldown of graphs/charts?

suryaavinash
Explorer

I would like to hide the SPL search query when we drill down on a chart or a graph.

I tried MACRO's and saved searches, but didn't work out. Can you please help?

It is to not expose my query to the End users.

0 Karma

somesoni2
Revered Legend

It will depending upon how you want to drilldown. For example (taking the query you gave as sample), the drilldown could be just to run another query based on col2. If that's the case, try something like this (run anywhere sample). In below example, all users would be able to see is sourcetype=ClickedValue

**All dashboard are created under "Search & Reporting" app.

Dashboard Name :thefirstdashboard

<dashboard>
  <label>thefirstdashboard</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count by sourcetype</query>
          <earliest>-4h@m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">10</option>
        <drilldown><link>/app/search/seconddashboard?sourcetype=$row.sourcetype$</link></drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Dashboard Name:seconddashboard

<dashboard>
  <label>seconddashboard</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=$sourcetype$| timechart count</query>
          <earliest>-4h@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">column</option>
      </chart>
    </panel>
  </row>
</dashboard>
0 Karma

somesoni2
Revered Legend

Could you explain more about your issue? Do you want to remove/hide the search string which is show in URL after drilldown? Providing your dashboard xml will help too.

0 Karma

suryaavinash
Explorer

I have created dashboards for users using splunk "dbquery" SPL command.

Ex: |dbquery "dbname" "select * from table1 where col1='xyz'" |stats count by col2

When User drills down , then i do not want him to view my query "select * from table1 where col1='xyz'".
Would like to understand how to hide the query from users view but allow him to drill down to see further results.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...