drilldown whilst using a search w stats values()

[hiddenkirby]

So this stemmed from a previous question, but i figured it warranted a new question. (hey more points for everyone)

I can't quickly think of a better example but if you do a search like the following... and select a username ... i guess i would expect to have it append " user=selectedcelltext".

index="sample" | stats values(user)

This would be a common issue for anyone running dashboards and wanted to see all the results for that user or something.

thoughts?

[sideview · Accepted solution]

It appears the drilldown code overall isnt capable of dealing with stats values(user). It may just be a little bug but it's quite possible that it's an undocumented limitation of the feature.

However this is a strange search to run in the first place, since you're going to get a single row with an enormous multivalued field containing every distinct value of user.

Change to running:

index="sample" | stats count by user 

or just index="sample" | top user

Those will give you results where each row is the unique user and the drilldown will deal with it properly.

[sideview]

I think we'll get it fixed yea. It's not a hard thing to get right - i think we just overlooked it. I'll take a look and file it if it's not captured already. Thanks for the catch.

[hiddenkirby]

Unfortunately the table i built for the dashboard (that my client requested) ... needs the "values" command. I'll have to see if i can get creative and give him the information he needs in a different way. Do you foresee the ability to drill-in from a "values" command coming through in a future splunk version?