Splunk Search

link to search

rashid47010
Communicator

I have a coloum chart with values displaying.
I select "configure link to a search"
when I click on coloum bar it opens the results in new windows. Problem is that beside showing act=unspecified|quarantine, it get the "number/count of event"

below is my query appear in searchbar:

iindex=trend sourcetype=e** cat="*e" **act=24 | dedup fixxth | table xxcxoxt fixxaxxh act TxxrxdMxxxroxxxleSHA1

search in the drilldown editor query is below:

iindex=trend sourcetype=*e act=$click.value2$ | dedup fixxth | table xxcxoxt fixxaxxh act TxxrxdMxxxroxxxleSHA1

Please help to fix this issue.

Tags (1)
0 Karma

nickhills
Ultra Champion

If I understand your question, you want a click on a row to open a search which specifies the 'act' field in the new search?

If that's correct, try this:

index=trend sourcetype=**e* act=$row.act$ | dedup fixxth | table xxcxoxt fixxaxxh act TxxrxdMxxxroxxxleSHA1
If my comment helps, please give it a thumbs up!
0 Karma

rashid47010
Communicator

I have a chart showing top 10 values.
when I click on bar it should show me the values instead of act=24.
I want to values of that fields beside the count.

act=block|quarantine

instead of act=24

I am using act=$click.value2$ but instead taking the values=block|quarantine, he toold value(act=24)

hope you understand my query

0 Karma

rashid47010
Communicator

Dear Nick,

I have a chart showing top 10 values.
when I click on bar it should show me the values instead of act=24.
I want to values of that fields beside the count.

act=block|quarantine

instead of act=24

I am using act=$click.value2$ but instead taking the values=block|quarantine, he toold value(act=24)

hope you understand my query

0 Karma

harishalipaka
Motivator

hi @rashid47010

u want to remove that link to search ust add in your proprties..

<option name="drilldown">none</option>
*********All the Best***********
0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...