Splunk Search

Why does the clickable pie chart only show the IP address in question?

jhilton90
Path Finder

I have a pie chart displaying the top 10 ip address for the past 60 minutes, and I'm trying to figure out how to then be able to click that bit of the pie chart, to then open a new window relevant information about that specific ip address instead of all the IP addresses in the pie chart

Labels (2)
Tags (1)
0 Karma

jhilton90
Path Finder

Okay so just to update, on the pie chart we have 10 offending ip addresses.

pie_chart.PNG

The drilldown options are set as follows:

drilldown_options.PNG

And so when I click on one of the ip address on the pie chart, I want a table below to be populated with the following details regarding that ip address: ipAddress, username, error, _time. However this is what appears when I click on any of the ip addresses in the pie chart

results_table.PNG

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Change the drilldown option to "Link to search" and choose "Custom".  Enter into the "Search string" box the SPL needed to create the desired table. Use $click.value2$ to refer to the selected IP address.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jhilton90
Path Finder

Thanks, I'll try that ASAP!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Define a drilldown for the chart that links to a search.  The search should reference the $click.value2$ token to find only the clicked IP address.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jhilton90,

you need to explore the drilldown feature:

https://docs.splunk.com/Documentation/Splunk/9.0.1/Viz/DrilldownIntro

https://docs.splunk.com/Documentation/Splunk/9.0.1/Viz/DrilldownIntro

and many other videos on the YouTube Splunk Channel.

I cannot help you more, because it depends on your dashboard, anyway, you could use the GUI drilldown feature that you can find in all panels (clicking on the three dots in edit mode).

viewing code, you should have in your dashboard something like this:

<drilldown>
   <link target="_blank">/app/<your_app>/<new_dashboard>?ip=$row.ip$</link>
</drilldown>

and in the new dashboard put a token with the same name you used (in my samle "ip").

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...