Splunk Search

Minimaze and Maximize a Cell or Drilldown and short the Text in Zell

bnybln030
Engager

Hi everyone,

i have in a table the result of a scanning script. Of course, the cells are much too large. Is there a way to minimize them and maximize them if necessary?

A drill down to a new page would be also ok, but how can I shorten or change the text in the cell so that the drilldown function is still possible since I use "clickvalue".

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bnybln030,

you could use subsearch to define the max lenght of a field and using drilldopwn, you could open a new panel containing the full field.

e.g. 

| eval your_field=substr(your_field,"10")

Ciao.

Giuseppe

bnybln030
Engager

Hi Guiseppe,

thanks for your fast reply. Can u say me, what is the best way to drilldown the colum and open a new panel containing the full field?

 

Kind Regadrs

bnybln030

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bnybln030.,

try to adapt this sample to your situation:

<dashboard version="1.1">
  <label>In-page Drilldown with Perma-Linking</label>
  <description>Enable in-page interaction through UI Editor or editing XML.</description>
  <row>
    <panel>
      <title>Main panel</title>
      <table id="master">
        <search>
          <query>
                 index=your_index
                 | eval visualized_field=substr(your_field,1,10)
                 | table _time host visualized_field your_field
          </query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <fields>_time, host, visualized_field</fields>
        <option name="drilldown">cell</option>
        <drilldown>
          <set token="form.your_field">$row.your_field$</set>
        </drilldown>
      </table>
    </panel>
    <panel>
      <chart id="detail" depends="$your_field$">
        <title>Detail: $your_field$</title>
        <search>
          <query>
                 index=your_index your_field="$your_field$"
                 | table your_field
          </query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
      </chart>
    </panel>
  </row>
</dashboard>

In few words:

  • in the first search you have two values: one to display in the first panel and one to pass as token,
  • with the click, you pass the full field as token to the second panel

I hint to see in the Splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603/) because you can find examples of in-page drilldown.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...