Splunk Search

How to link to search in query?

sahana
Engager

Hi 

I have a panel with query below

index=int_166167 env = SIT appName="GCR" message="Post Login*"| bucket _time span= 15m| stats count(userId) as loginUsers ,min(timeTaken) as minSLA,max(timeTaken) as maxSLAcount by _time | sort -_time|table  _time,loginUsers,minSLA,maxSLA

the panel appears as like below

time loginUsers minSLA maxSLA
28-02-2022 11:00 45 12 67
28-02-2022 11:15 60 13 74
28-02-2022 11:30 35 25 82
28-02-2022 11:45 46 34 45
28-02-2022 11:00 70 57 90
28-02-2022 12:00 35 24 57

My requirement is like on click of the maxSLA value (for ex:90) it should link to search which shows the result of particular one max SLA event with 90 from those 70 users

Kindly help on this. 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The maxSLA is related to the time period not specifically the users, so your drilldown should use the time from the row clicked ($click.value$) as the earliest and add 15 minutes for the latest in the drilldown panel search.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...