Okay @rwheeloc I think I might have something which will work for you. Its currently based on hosts in _internal but you will hopefully work out whats going on... There is a table off-screen with a search which generates the list of hosts with the domain added: You can then use this in your search as | search host IN ($calcTokens:result.fqdn$) Below is the full Dashboard Studio definition for you to have a play around with, hopefully this can be adapted for what you need. You can make that calcTokens search do anything such as a lookup of case statement to determine the index etc of a particular value. Full dashboard definition: {
"title": "Test",
"description": "",
"inputs": {
"input_xErPd246": {
"dataSources": {
"primary": "ds_BVphVPJh"
},
"options": {
"defaultValue": [],
"items": [
{
"label": "All",
"value": "*"
}
],
"token": "host_dropdown"
},
"title": "Host",
"type": "input.multiselect"
}
},
"defaults": {
"dataSources": {}
},
"visualizations": {
"viz_54DWfjK8": {
"dataSources": {
"primary": "ds_UgFKNfjH"
},
"title": "This is hidden",
"type": "splunk.table"
},
"viz_RfxFwzef": {
"dataSources": {
"primary": "ds_Ldb8veEn"
},
"eventHandlers": [
{
"options": {
"tokens": [
{
"key": "row.n.value",
"token": "value"
}
]
},
"type": "drilldown.setToken"
},
{
"options": {
"newTab": true,
"url": "https://google.com?value=$value$"
},
"type": "drilldown.customUrl"
}
],
"title": "_internal by host",
"type": "splunk.table"
},
"viz_fvzrSMeV": {
"dataSources": {
"primary": "ds_K2pCXGuI_ds_Ldb8veEn"
},
"eventHandlers": [
{
"options": {
"tokens": [
{
"key": "row.n.value",
"token": "value"
}
]
},
"type": "drilldown.setToken"
},
{
"options": {
"newTab": true,
"url": "https://google.com?value=$value$"
},
"type": "drilldown.customUrl"
}
],
"title": "_internal by fqdn",
"type": "splunk.table"
}
},
"dataSources": {
"ds_BVphVPJh": {
"name": "Search_2",
"options": {
"query": "| tstats count where index=_internal by host",
"queryParameters": {
"earliest": "-4h@m",
"latest": "now"
}
},
"type": "ds.search"
},
"ds_K2pCXGuI_ds_Ldb8veEn": {
"name": "Search_1 copy 1",
"options": {
"query": "| tstats count where index=_internal by host\n| eval host=host.\".mydomain.com\"\n| search host IN ($calcTokens:result.fqdn$)\n",
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
},
"type": "ds.search"
},
"ds_Ldb8veEn": {
"name": "Search_1",
"options": {
"query": "| tstats count where index=_internal host IN ($host_dropdown$) by host",
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
},
"type": "ds.search"
},
"ds_UgFKNfjH": {
"name": "calcTokens",
"options": {
"enableSmartSources": true,
"query": "| makeresults \n| eval host=split(\"$host_dropdown$\",\",\")\n| foreach host mode=multivalue \n [| eval fqdn=mvappend(fqdn,<<ITEM>>.\".mydomain.com\")]\n",
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
},
"type": "ds.search"
}
},
"layout": {
"globalInputs": [
"input_xErPd246"
],
"layoutDefinitions": {
"layout_1": {
"options": {
"display": "auto-scale"
},
"structure": [
{
"item": "viz_RfxFwzef",
"position": {
"h": 210,
"w": 340,
"x": 270,
"y": 50
},
"type": "block"
},
{
"item": "viz_54DWfjK8",
"position": {
"h": 300,
"w": 520,
"x": 1220,
"y": 30
},
"type": "block"
},
{
"item": "viz_fvzrSMeV",
"position": {
"h": 210,
"w": 540,
"x": 620,
"y": 50
},
"type": "block"
}
],
"type": "absolute"
}
},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
}
} Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will
... View more
