Splunk Search

drilldown whilst using a search w stats values()

hiddenkirby
Contributor

So this stemmed from a previous question, but i figured it warranted a new question. (hey more points for everyone)

I can't quickly think of a better example but if you do a search like the following... and select a username ... i guess i would expect to have it append " user=selectedcelltext".

index="sample" | stats values(user)

This would be a common issue for anyone running dashboards and wanted to see all the results for that user or something.

thoughts?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

It appears the drilldown code overall isnt capable of dealing with stats values(user). It may just be a little bug but it's quite possible that it's an undocumented limitation of the feature.

However this is a strange search to run in the first place, since you're going to get a single row with an enormous multivalued field containing every distinct value of user.

Change to running:

index="sample" | stats count by user 

or just index="sample" | top user

Those will give you results where each row is the unique user and the drilldown will deal with it properly.

View solution in original post

sideview
SplunkTrust
SplunkTrust

It appears the drilldown code overall isnt capable of dealing with stats values(user). It may just be a little bug but it's quite possible that it's an undocumented limitation of the feature.

However this is a strange search to run in the first place, since you're going to get a single row with an enormous multivalued field containing every distinct value of user.

Change to running:

index="sample" | stats count by user 

or just index="sample" | top user

Those will give you results where each row is the unique user and the drilldown will deal with it properly.

sideview
SplunkTrust
SplunkTrust

I think we'll get it fixed yea. It's not a hard thing to get right - i think we just overlooked it. I'll take a look and file it if it's not captured already. Thanks for the catch.

0 Karma

hiddenkirby
Contributor

Unfortunately the table i built for the dashboard (that my client requested) ... needs the "values" command. I'll have to see if i can get creative and give him the information he needs in a different way. Do you foresee the ability to drill-in from a "values" command coming through in a future splunk version?

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...