Yes, it is working like I envisioned it would. Thanks for your advice. ... View more

Sounds great! I'll give that a try. Thank you, cmerriman! ... View more

If they were just laid out neatly in a table, would they be interactive or would they return a NULL? ... View more

Actually, no. I want to just click the 'OR'd results. The format command looks like it is working the way I would need it to, especially when there are multiple ICID's from a particular event. Let's say there are 10 ICID's that were found with the initial search. Having them strung together with an OR should show the search thus: icid=123456 OR icid=234567 OR icid-345678, etc. If I go to an actual table, I'd only be able to click one at a time, and if there are 100's or thousands of icid's...you get the picture. But what I have in that query with the token $retrieve$ is returning a search with the word NULL in it. ... View more

Sure, I hope it translates properly <title>ICID</title> <table> <title>ICID</title> <search> <query>index=primary sourcetype=email_server "$ip$" | stats count BY icid | table icid | format</query> </search> <drilldown> <set token="show_panel">true</set> <set token="retrieve">$click.value$</set> </drilldown> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="table.drilldown">all</option> <option name="table.wrap">1</option> <option name="type">list</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> <panel depends="$retrieve$"> <event> <title>Result of ICID search retrieval</title> <search> <query>index=primary sourcetype=email_server $retrieve$</query> <earliest>-4h@h</earliest> <latest>now</latest> </search> <option name="count">5</option> </event> </panel> ... View more

Not sure what happened, but when I clicked the value returned from the original search, a new panel popped up with unexpected data in it. When I clicked the magnifying glass to 'open in search' and see what the search looked like, the search string only had the word'NULL' in it and was looking for all occurrences of NULL in the past four hours. Any thoughts on what may have occurred with the new query? ... View more

The code falls under the option name= and are as follows - wrap, rowNumbers, dataOverlayMode, list.drolldown,list.wrap, maxLines, raw.drilldown, table.drilldown, table.wrap, type, drilldown, and count with the answer to those options listed above. TY ... View more

Hmmmm - that source code didn't post correctly true false none full 1 5 full all 1 list cell 10 ... View more

Cmerriman - the search is thus: index=InnerIndexHere sourcetype=InnerSourcetypeHere "ip.of.offending.addr" | stats count BY ICID | table ICID | format This returns a subsearch of the results found in the ICID field. I would like to the results to be capable of drilldown by clicking the contents of the cell to display the results of each ICID number (ie; was there DNS info for the IP, was it blacklisted, did it create a mid, did it close). Here is the source: true false none full 1 5 full all 1 list cell 10</option and the link to the previous question: https://answers.splunk.com/answers/552608/how-can-i-take-the-results-from-a-search-and-gener.html Thanks for taking a timeout to assist on a Holiday! ... View more

Yes, thanks Woodcock, you taught me much in that regard! One last thing - do you have any idea why the drilldown isn't working? When I click on the results that the search produced, it shows the original search instead of the results of the search - just like clicking the magnifying glass icon does. In the source code, drilldown is set to cell. Any thoughts? ... View more

OK, It is now producing the results that I need - ( icid="432745756" ) OR ( icid="99159202" ) OR ( icid="99404073" ) - under the 'search' heading of the table. Since this is a newer version of Splunk (6.3 I think), drilling down on the search results will need to be performed in the XML portion of the code as opposed to editing the panel options. ... View more

I think we are getting closer - the results returned a table with two headings: icid and search. There was no data (no outer index/sourcetype specified?) returned under the icid heading, and search returned ( ( icid="432670647" ) OR ( icid="99283979" ) ) ... View more

Woodcock - not sure I understand outer versus inner indexes and sourcetypes. ... View more

Thanks, somesoni2, I see your point regarding csv versus lookup. I will try that option next. ... View more

Sorry for the delay, was able to narrow a few things down. My search looks like this and is part of a dashboard: index=primary_index sourcetype=firewall ref="$ref$" | stats count by src, dst, ref, method, webhost, uri | sort ip, -url I'll still have to do something with listing hostnames, but will tweak as I can. Thank you for your previous responses - shift work interferes with my replies. ... View more

Will probably have the search check all indexes either with index=* or by listing them with "OR" - maybe even make a dropdown box where there is a choice as to which index to check. ... View more