How to use condition search by check on $click.value$ of parameter.

[mindterrian]

Hello

I have 2 chart (1. Top 10 Signature) (2. Source IP Address)
My query can show overall event but can't show specific event when click.

This is my query.

    On chart "Top 10 Signature"
    host="SRV-IPS-MGMT" NOT SyslogAuditLogForwarder | stats count by ips_name | sort 10 - count

    On chart "Source IP Address"
    host="SRV-IPS-MGMT" NOT SyslogAuditLogForwarder | stats count by ips_src_ip | sort - count

I'm set token of Edit Drilldown on chart "Top 10 Signature" because i want to show only event of signature that i'm click on chart "Source IP Address" but i don't know how to use condition search.

I want use condition like
if token="do not have value" do "query1"
else do "query2"

Thank you

[woodcock]

Check out the Splunk Dashboards Examples app:

https://splunkbase.splunk.com/app/1603/

[woodcock]

I am completely confused about what you might mean. I do not think that it is understandable enough for anyone to help you directly.

[mindterrian]

Hello lakshman239

I’m set token on drilldown already and my search is not same.
I don’t know how to use condition on search for show overall and specific signature.

Thank you

[lakshman239]

Have you looked at https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/ContextualDrilldown?

you can go specific via drill-down search from your top panel.

In the above, as your base search is same, you can also look at base and post-process search to improve performance.