Splunk Search

drilldown of pie chart by business unit

Path Finder

I'm currently trying to build a dashboard that would drill down by site name.

Here's an example of the site name: ABC-DEF-PRIV-APJ-AU-SYD.

So the drill-down would be APJ(Region)--> ABC(Business Unit) ---> assets

Could someone point me in the right direction to accomplish this?

Here's a snippet of the code and visualization that I'm getting:

index="lob_data" sourcetype="csv" sitename!="hec*" sitename!="corp*"
| where vulnAge > 30
| stats count(IP) as "Total Systems" by sitename,vulnAge

alt text

0 Karma


@payton_tayvion for the community to assist you better please provide more details on the data and your drilldown use case? Do you want to set three tokens from your site i.e. Region, Business Unit and Asset?
Also what it the breakup for site? In your example ABC-DEF-PRIV-APJ-AU-SYD is first position ABC always Business Unit? Is 4th position APJ always region? Where is asset? What is position 2, 3, 5 and 6?

Seems like you need Simple XML <eval> with split() and mvindex() on $row.site$ to set the required tokens. But we will not be able to assist you better without further details.

On a different note: Second| where seems expensive. move vulnAge to main search. Also for 10K+ results you want to use Pie Chart? Either switch to a different viz or use Trellis Layout.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

yeah so right now I'm focusing on creating a regex that will pull ABC which is the business unit, but when it pulls the business unit I only want it to pull for each business unit.

for example:
there may be multiple ABC units but I only want it to show once on the pie chart

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...