Splunk Search

drilldown whilst using a search w stats values()

hiddenkirby
Contributor

So this stemmed from a previous question, but i figured it warranted a new question. (hey more points for everyone)

I can't quickly think of a better example but if you do a search like the following... and select a username ... i guess i would expect to have it append " user=selectedcelltext".

index="sample" | stats values(user)

This would be a common issue for anyone running dashboards and wanted to see all the results for that user or something.

thoughts?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

It appears the drilldown code overall isnt capable of dealing with stats values(user). It may just be a little bug but it's quite possible that it's an undocumented limitation of the feature.

However this is a strange search to run in the first place, since you're going to get a single row with an enormous multivalued field containing every distinct value of user.

Change to running:

index="sample" | stats count by user 

or just index="sample" | top user

Those will give you results where each row is the unique user and the drilldown will deal with it properly.

View solution in original post

sideview
SplunkTrust
SplunkTrust

It appears the drilldown code overall isnt capable of dealing with stats values(user). It may just be a little bug but it's quite possible that it's an undocumented limitation of the feature.

However this is a strange search to run in the first place, since you're going to get a single row with an enormous multivalued field containing every distinct value of user.

Change to running:

index="sample" | stats count by user 

or just index="sample" | top user

Those will give you results where each row is the unique user and the drilldown will deal with it properly.

sideview
SplunkTrust
SplunkTrust

I think we'll get it fixed yea. It's not a hard thing to get right - i think we just overlooked it. I'll take a look and file it if it's not captured already. Thanks for the catch.

0 Karma

hiddenkirby
Contributor

Unfortunately the table i built for the dashboard (that my client requested) ... needs the "values" command. I'll have to see if i can get creative and give him the information he needs in a different way. Do you foresee the ability to drill-in from a "values" command coming through in a future splunk version?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...