Hi fellow Splunkers 🙂
I have a table containing various fields such as sourcetype and username etc. I want to enable the user to always drilldown on sourcetype and user + what ever field is clicked on. Here is how my code looks like now
<panel>
<table id="master">
<title>Test</title>
<search>
<query>main search... | bucket _time span=5m | stats count by sourcetype,_time,user,app,action,host,src,dest</query>
<earliest>$s_time.earliest$</earliest>
<latest>$s_time.latest$</latest>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">true</option>
<drilldown>
<set token="s_sourcetype">$row.sourcetype$</set>
<set token="s_user">$click.value2$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<event id="detail" depends="$s_sourcetype$">
<title>Detailed events by sourcetype $s_event_source$ and username $s_user$</title>
<search>
<query>main search... | search (sourcetype="$s_sourcetype$" user="$s_user$" host="$s_host$" src="$s_src$" dest="$s_dest$")</query>
<earliest>$s_time.earliest$</earliest>
<latest>$s_time.latest$</latest>
</search>
<option name="count">20</option>
<option name="maxLines">5</option>
<option name="rowNumbers">1</option>
<option name="type">list</option>
</event>
</panel>
For now this works just fine if I only click on the user field in the master table. It will pass the token to the second panel and show results in an event list with the title e.g. "Detailed events by sourcetype WinEventLog:Security and username admin"
But, if a user clicks any of the other fields, like "host", it will show: "Detailed events by sourcetype WinEventLog:Security and username 127.0.0.1" and pass the host token to the user token. I tried to follow the "Contextual example with multiple conditions" at Splunk docs (can't post link) and that is simple with just sourcetype and log_level fields, however I want to select value in table and not by column name as this will search for user=user. With my example I'm not able to figure out how to do this.
Any suggestions?
... View more
