Splunk Search

drilldown whilst using a search w stats values()

hiddenkirby
Contributor

So this stemmed from a previous question, but i figured it warranted a new question. (hey more points for everyone)

I can't quickly think of a better example but if you do a search like the following... and select a username ... i guess i would expect to have it append " user=selectedcelltext".

index="sample" | stats values(user)

This would be a common issue for anyone running dashboards and wanted to see all the results for that user or something.

thoughts?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

It appears the drilldown code overall isnt capable of dealing with stats values(user). It may just be a little bug but it's quite possible that it's an undocumented limitation of the feature.

However this is a strange search to run in the first place, since you're going to get a single row with an enormous multivalued field containing every distinct value of user.

Change to running:

index="sample" | stats count by user 

or just index="sample" | top user

Those will give you results where each row is the unique user and the drilldown will deal with it properly.

View solution in original post

sideview
SplunkTrust
SplunkTrust

It appears the drilldown code overall isnt capable of dealing with stats values(user). It may just be a little bug but it's quite possible that it's an undocumented limitation of the feature.

However this is a strange search to run in the first place, since you're going to get a single row with an enormous multivalued field containing every distinct value of user.

Change to running:

index="sample" | stats count by user 

or just index="sample" | top user

Those will give you results where each row is the unique user and the drilldown will deal with it properly.

sideview
SplunkTrust
SplunkTrust

I think we'll get it fixed yea. It's not a hard thing to get right - i think we just overlooked it. I'll take a look and file it if it's not captured already. Thanks for the catch.

0 Karma

hiddenkirby
Contributor

Unfortunately the table i built for the dashboard (that my client requested) ... needs the "values" command. I'll have to see if i can get creative and give him the information he needs in a different way. Do you foresee the ability to drill-in from a "values" command coming through in a future splunk version?

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...