Dashboards & Visualizations

How to create a drilldown where a value clicked in a table is passed to a search string that populates other dashboard panels?

cgekoski
Path Finder

I have been searching with no luck, probably because i do not know exactly how to phrase the question. I basically have a search looking against our firewall logs for outbound destination mail ports; 25, 110,143,993,etc. then piped to a chart count by source ip and destination port and it generates a stats panel with the source ip first, then each port respectively across the rows.

What i want to be able to do then is have a search field box on the dashboard that when i click an IP from the columns it places it inside the field, which then starts populating other panels within my dashboard. Right now i have it to where i have to manually type in the IP into the field, Not a big deal but wanted the ease of clicking for other admins and help desk techs.

right now my other panels in the dashboard have a search string with the extra piece of src_ip="$field1$" within the search string.

Also FYI, very fresh with splunk so please answer in lamans terms if possible

Thanks,

Cory

0 Karma

satishsdange
Builder

ramdaspr
Contributor

You have most of the solution already implemented. Whats left is to define a token called $field1$ on the chart using the drilldown tag. You can look through the examples and details on the docs.

Set the Search field box token name to $field1$ so that it auto populates when you click on the chart and you already have the other panels updated to include the token so they will fire only when an ip is selected on the chart.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...