Splunk - Specify drill down search

1
votes

I'm relatively new to Splunk and am creating a new view to display the average timings of certain events over the past 5 mins. I've created a macro search to carry out the search which takes two parameters (transaction name and duration to search), so in my first panel this is EVENT_*_LOGIN and -5m. The view currently displays a simple table of results per distinct event name.

What I would like to do is when a user clicks on a particular row it will drill down to timeline view of all events for that transaction over the past 4 hours. Is there a way to specify the information a click or drill down displays?

Apologies if this vague, please message me if more info. needed.

Thanks in advance

2
splunksideviewutils

2 Answers

1
votes

The simplest approach is to use SideView Utils and leverage their Redirector or Search module to custom fill the search query based upon what the user clicks.

Opens Custom Search in Popup based upon clicked Chart

<module name="FlashChart">
    <param name="width">100%</param>
    <module name="Redirector">
        <param name="popup">True</param>
        <param name="url">flashtimeline</param>
        <param name="arg.q">search MyField="$click.value$" eventtype="#$click.name2$" hoursago=4</param>
    </module>
</module>

Opens Custom Search in Popup based upon clicked Table element

<module name="SimpleResultsTable">
    <param name="drilldown">all</param> 
    <module name="Redirector">
        <param name="popup">True</param>
        <param name="url">flashtimeline</param>
        <param name="arg.q">search MyField="$click.value$" eventtype="#$click.name2$" hoursago=4</param>
    </module>
</module>

You can access the documentation for Search/Redirector using your Splunk Web install:

    http://[splunk_web]/en-US/modules#Splunk.Module.Redirector
    http://[splunk_web]/en-US/modules#Splunk.Module.Search
0
votes

As of Splunk version 5 they now support dynamic drilldown. Check the docs here to see if that does what you need.