Dashboards & Visualizations

How to drill down/ launch another search with parameter from results table in dashboard?

nicolasperrenou
Engager

Hi all. I have a advanced XML dashboard that shows me a table with some results from an web server access log search. When I click on a row, i want Splunk to open a new window and start a new search with a parameter from the search in the dashboard. More specifically, i want the new search to use the IP that I found in the base search and search in another type of log for that ip at the specific time. How can I achieve this (preferrably in a simple way)? This is mi first try, but the second search does not yet take the ip in consideration... Also the timerange needs to be changed, so that i find events that happen slightly before that log event. It would be cool if I simply could write something like

sourcetype="WebAuthLog" type="Login" ip=%ip% latest="%_time%" earliest="%_time%-1h"

So here is my code:

<view template="dashboard.html">
  <label>Test Dashboard</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="True">
    <param name="search">sourcetype="W3CAccessLogAdapter" method="POST" uri="/"</param>

      <module name="TimeRangePicker">
      <param name="searchWhenChanged">True</param>

      <module name="Paginator">
        <param name="entityName">events</param>
        <param name="count">50</param>

        <module name="SimpleResultsTable">
          <param name="displayRowNumbers">true</param>
          <param name="drilldown">row</param>
          <param name="entityName">events</param>
          <param name="fields">clientip, req_time</param>

          <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="True">
            <param name="search">sourcetype="WebAuthLog" type="Login" </param>

            <module name="ConvertToDrilldownSearch">
              <module name="ViewRedirector">
                <param name="viewTarget">flashtimeline</param>
                <param name="popup">true</param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>

Thanks and best regards

Nicolas

thall79
Communicator

Have you tried creating another HiddenSearch module before your ViewRedirector. This should pass your click value down to that hidden search which will output to a new window with the view redirector.

For the time part need to play around a little.

travis.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...