Dashboards & Visualizations

Drilldown set form parameters and search again

phoenixdigital
Builder

Hi All,

I am trying to work out if this is even possible with drilldowns and forms.

At the end of this post is a very simple form which searches an apache logfile and generates a table of all clientIP addresses. I understand the form is useless as it will cause the table to only show one result. I have just dumbed it down so I can get an answer to the question.

The form allows the user to enter an IP address to restrict by which is then passed onto the search.

Question: Is there a way to setup a drilldown on the table whereby when the user clicks on an IP address it is populated to the form field and the search is performed again?

I have looked through all the advanced XML queries and demos but I cant seem to find one that behaves in this manner. Is it even possible?

    <form class="formsearch">
    <label>Client Details</label>

    <fieldset>
        <input type="text" token="clientIP" searchWhenChanged="false">
            <default>*</default>
        </input>
    <input type="time" searchWhenChanged="false"/>
    </fieldset>

    <row>
        <table>
            <title>Top client IP addresses</title>
            <searchTemplate>index=webserver (sourcetype=access_combined OR sourcetype=vhost_access_combined) clientip="$clientIP$" | top limit=10 clientip</searchTemplate>
        </table>
    </row>
</form>
Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

There was a very similar question recently and I advised the asker to download Sideview Utils and check out how it's done using those modules to augment the core Splunk modules. This is a pretty core use case of Sideview Utils, and the ability to drilldown and prepopulate elements in form search views is one of the main reasons I created the framework.

http://splunk-base.splunk.com/answers/6234/form-search-drill-down-action-to-set-field-value?page=1#2...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...