Is there a way I can hardcode a search to 2 drilldown values? Basically this is what I am trying to achieve: Drilldown with 2 options -> Network traffic from A to B &, from B to A. I have for the time created 2 panes which display 2 panels (with network traffic both directions). But I am trying to come up with a single panel which, upon selecting the traffic direction from the drilldown, displays only that information.
Try something like this (this is a sample dashboard that can run on any splunk instance, update the searches/labels as per yours)
<form>
<label>Dynamic Direction</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="host" searchWhenChanged="true">
<label>Host</label>
<search>
<query>| metadata type=hosts index=* | table host</query>
</search>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
</input>
<input type="dropdown" token="direction" searchWhenChanged="true">
<label>Direction</label>
<choice value="src_interface="A*"">A to B</choice>
<choice value="dest_interface="A*"">B to A</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<title>$direction$</title>
<search>
<query>index=_internal | stats count by sourcetype | eval src_interface=if(like(sourcetype,"s%"),"A*","B*")| eval dest_interface=if(like(sourcetype,"s%"),"B*","A*")| search $direction$</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
</form>
What is your current query?
I'll give the part of query and what I am trying to achieve:
Query 1: index=firewall host=$value$ | search action!="success" AND src_interface="A*"
Query 2: index=ffirewall host=$value$ | search action!="success" AND dest_interface="A*"
I have 2 drilldown boxes. One which selects the host using $value$ variable. That's working fine.
The next drill down I got to select the traffic direction (query1-> src_interface, query 2-> dest_interface).