Dashboards & Visualizations

Drilldowns in Dashboard Studio

Stiaan
Explorer

Hi Splunk, 

I created a dashboard with various panels. Some of the panels are tables with drilldown searches allowing you to click on the value, and opening a new tab using the value clicked on ($row.user.value$) in the new search. 

However, for some reason the drilldown on one panel opens the search without populating the variable: $row.user.value$
All the other panels' drilldown searches work.

Source code of panel:

 

{
    "type": "splunk.table",
    "options": {
        "count": 100,
        "dataOverlayMode": "none",
        "drilldown": "none",
        "showRowNumbers": false,
        "showInternalFields": false
    },
    "dataSources": {
        "primary": "ds_aaaa"
    },
    "title": "Panel One (Last 30 Days)",
    "eventHandlers": [
        {
            "type": "drilldown.linkToSearch",
            "options": {
                "query": "index=\"winlog\" EventCode=4625 user=$row.user.value$",
                "earliest": "auto",
                "latest": "auto",
                "type": "custom",
                "newTab": true
            }
        }
    ],
    "context": {},
    "showProgressBar": false,
    "showLastUpdated": false
}

 


The SPL after clicking on the table value:
index="winlog" EventCode=4625 user=$row.user.value$

Why does the $row.user.value$ not populate?

Labels (1)
0 Karma
1 Solution

Stiaan
Explorer

I was able to fix my issue. 

I simply added the "rename" function in my main table search.

| advhunt cred=all renew=True query="DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName has 'file.exe'
| project DeviceName, FileName, ProcessCommandLine, FolderPath, AccountName"
| spath input=_raw
| stats count by AccountName,DeviceName
| sort -count



 

| advhunt cred=all renew=True query="DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName has 'file.exe'
| project DeviceName, FileName, ProcessCommandLine, FolderPath, AccountName"
| spath input=_raw
| rename AccountName as user
| stats count by user,DeviceName
| sort -count

 

View solution in original post

0 Karma

Stiaan
Explorer

I was able to fix my issue. 

I simply added the "rename" function in my main table search.

| advhunt cred=all renew=True query="DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName has 'file.exe'
| project DeviceName, FileName, ProcessCommandLine, FolderPath, AccountName"
| spath input=_raw
| stats count by AccountName,DeviceName
| sort -count



 

| advhunt cred=all renew=True query="DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName has 'file.exe'
| project DeviceName, FileName, ProcessCommandLine, FolderPath, AccountName"
| spath input=_raw
| rename AccountName as user
| stats count by user,DeviceName
| sort -count

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share the rest of the configuration e.g. the data source with the search being used

0 Karma

Stiaan
Explorer

Table SPL:

| advhunt cred=all renew=True query="DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName has 'file.exe'
| project DeviceName, FileName, ProcessCommandLine, FolderPath, AccountName"
| spath input=_raw
| stats count by AccountName,DeviceName
| sort -count


Source Code of Panel:

{
    "type": "splunk.table",
    "options": {
        "count": 100,
        "dataOverlayMode": "none",
        "drilldown": "none",
        "showRowNumbers": false,
        "showInternalFields": false
    },
    "dataSources": {
        "primary": "ds_xxxxx"
    },
    "title": "File.exe (Last 30 Days)",
    "eventHandlers": [
        {
            "type": "drilldown.linkToSearch",
            "options": {
                "query": "| inputlookup lookuptable where field1=$row.user.value$\n| table field1, field2",
                "earliest": "auto",
                "latest": "auto",
                "type": "custom",
                "newTab": true
            }
        }
    ],
    "context": {},
    "showProgressBar": false,
    "showLastUpdated": false
}


SPL for search on click:

| inputlookup lookuptable where field1=$row.user.value$
| table field1, field2



0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...