Splunk Search

Why does the clickable pie chart only show the IP address in question?

jhilton90
Path Finder

I have a pie chart displaying the top 10 ip address for the past 60 minutes, and I'm trying to figure out how to then be able to click that bit of the pie chart, to then open a new window relevant information about that specific ip address instead of all the IP addresses in the pie chart

Labels (2)
Tags (1)
0 Karma

jhilton90
Path Finder

Okay so just to update, on the pie chart we have 10 offending ip addresses.

pie_chart.PNG

The drilldown options are set as follows:

drilldown_options.PNG

And so when I click on one of the ip address on the pie chart, I want a table below to be populated with the following details regarding that ip address: ipAddress, username, error, _time. However this is what appears when I click on any of the ip addresses in the pie chart

results_table.PNG

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Change the drilldown option to "Link to search" and choose "Custom".  Enter into the "Search string" box the SPL needed to create the desired table. Use $click.value2$ to refer to the selected IP address.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jhilton90
Path Finder

Thanks, I'll try that ASAP!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Define a drilldown for the chart that links to a search.  The search should reference the $click.value2$ token to find only the clicked IP address.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
Esteemed Legend

Hi @jhilton90,

you need to explore the drilldown feature:

https://docs.splunk.com/Documentation/Splunk/9.0.1/Viz/DrilldownIntro

https://docs.splunk.com/Documentation/Splunk/9.0.1/Viz/DrilldownIntro

and many other videos on the YouTube Splunk Channel.

I cannot help you more, because it depends on your dashboard, anyway, you could use the GUI drilldown feature that you can find in all panels (clicking on the three dots in edit mode).

viewing code, you should have in your dashboard something like this:

<drilldown>
   <link target="_blank">/app/<your_app>/<new_dashboard>?ip=$row.ip$</link>
</drilldown>

and in the new dashboard put a token with the same name you used (in my samle "ip").

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...