Splunk Search

How to use condition search by check on $click.value$ of parameter.

mindterrian
New Member

Hello

I have 2 chart (1. Top 10 Signature) (2. Source IP Address)
My query can show overall event but can't show specific event when click.

This is my query.

    On chart "Top 10 Signature"
    host="SRV-IPS-MGMT" NOT SyslogAuditLogForwarder | stats count by ips_name | sort 10 - count

    On chart "Source IP Address"
    host="SRV-IPS-MGMT" NOT SyslogAuditLogForwarder | stats count by ips_src_ip | sort - count

I'm set token of Edit Drilldown on chart "Top 10 Signature" because i want to show only event of signature that i'm click on chart "Source IP Address" but i don't know how to use condition search.

I want use condition like
if token="do not have value" do "query1"
else do "query2"

Thank you

Tags (1)
0 Karma

woodcock
Esteemed Legend

Check out the Splunk Dashboards Examples app:

https://splunkbase.splunk.com/app/1603/

0 Karma

woodcock
Esteemed Legend

I am completely confused about what you might mean. I do not think that it is understandable enough for anyone to help you directly.

0 Karma

mindterrian
New Member

Hello lakshman239

I’m set token on drilldown already and my search is not same.
I don’t know how to use condition on search for show overall and specific signature.

Thank you

0 Karma

lakshman239
Influencer

Have you looked at https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/ContextualDrilldown?

you can go specific via drill-down search from your top panel.

In the above, as your base search is same, you can also look at base and post-process search to improve performance.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...