Dashboards & Visualizations

Can't unset drilldown token in viz

mmcg
Explorer

Hi,

First time poster here been lurking for too long and I just can't seem to understand where I am going wrong here...

I have created a cluster map that displays the frequency of observed comms with 'bad IPs' . I want to to run a search that will return any IPs that have communicated with the selected bad ip on click, however I'm having an issue unsetting the token for a drilldown, although I am not getting any errors in the XML. It is constantly set at the first value I ever clicked on.

Can anyone see any errors related to the unset in my XML?

Thanks for your help in advance.

<dashboard>
  <label>Bad IPs</label>
  <row>
    <panel>
      <title>Blacklisted IPs Observed</title>
      <map>
        <search>
          <query>| tstats summariesonly=t count FROM datamodel=Network_Traffic.All_Traffic GROUPBY All_Traffic.src_ip 
| rename All_Traffic.src_ip as HostAddress 
| lookup bad_ip.csv HostAddress OUTPUT HostAddress as ip 
| search ip=*
| append 
    [| tstats summariesonly=t count FROM datamodel=Network_Traffic.All_Traffic GROUPBY All_Traffic.dest_ip 
| rename All_Traffic.dest_ip as HostAddress 
| lookup bad_ip.csv HostAddress OUTPUT HostAddress as ip 
| search ip=*]
    | iplocation ip
    | geostats globallimit=0 count by ip</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="mapping.type">marker</option>
        <drilldown>
          <set token="ip_token">$click.name$</set>
          <link target="_blank">search?q=| datamodel Network_Traffic All_Traffic search| search All_Traffic.src_ip=$ip_token|s$ OR All_Traffic.dest_ip=$ip_token|s$
| table All_Traffic.src_ip ,All_Traffic.dest_ip 
| rename All_Traffic.src_ip as Source, All_Traffic.dest_ip as dest_ip 
| stats values(dest_ip) as "Destination" by Source&amp;earliest=-24h@h&amp;latest=now
          <unset token="ip_token"></unset>
        </drilldown>
      </map>
    </panel>
</dashboard>
0 Karma

niketn
Legend

If your purpose is to get the token from drilldown and use it as a Search input in new link, you need not set and unset token. You can directly use default drilldown token i.e. $click.name$ in the <link>

         <drilldown>
           <link target="_blank">search?q=| datamodel Network_Traffic All_Traffic search| search All_Traffic.src_ip=$click.name|s$ OR All_Traffic.dest_ip=$click.name|s$
 | table All_Traffic.src_ip ,All_Traffic.dest_ip
 | rename All_Traffic.src_ip as Source, All_Traffic.dest_ip as dest_ip
 | stats values(dest_ip) as "Destination" by Source&amp;earliest=-24h@h&amp;latest=now
         </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mmcg
Explorer

My mistake I should not have been using $click.name$ as it constantly uses the first field, I had to rewrite my base search.

0 Karma

niketn
Legend

I think it should be $click.value$ not $click.name$. If you can sample the output of the final table used to plot map, we would be able to confirm the exact default token for the map drilldown.

If you want to figure out on your own, you can refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#map_.28event_tokens.29

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mmcg
Explorer

geobin - Lat - Long - IP1 - IP2 - so on
value - laval - lonval - countval - countval

The problem is that whether I use click.value or click.name it always defaults to the first value (i.e IP1.count or IP1.

It appears to be a limitation of geostats, as I would really have expected to get this working in Splunk.

However I'm open to suggestions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...