Dashboards & Visualizations

Question about adding new time to search around events based on "parent"-search in sub/ child -search

lmyrefelt
Builder

Hi, I would like to know if it is possible to do the following;

I am trying to create a dashboard allowing our networking and help-desk team to search for user activity. They will first be presented with the option of the time frame to search for, after this they will have to put in a username or * to search for.

This will then give them back a table with username and some other fields. All the fields in this table is then selectable to do another search. However this sub-search returns all events that contains the selected field for the above selected time frame, lets say last 30 days.
However what i would like to do is to allow the people to select the username and time, for example 30 days to search for, than have them to select one of the fields from the results and do another search based on that field in a "new" with a new time set like 30 mins AROUND / or at least present me / us with the results 30 mins around this event from witch the field they chose existed. Not the whole 30days until now.

Did i make myself understandable ? 😛

The dashboard / searches ( interesting part ) comes here;

module name="Message" layoutPanel="messaging">
splunk.search.job
True
1


dashboard


index=blah user="$Username$" | table something, something, something
Network blah activity

<module name="TimeRangePicker">
    <param name="default">Last 15 minutes</param>
    <param name="searchWhenChanged">False</param>

  <module name="ExtendedFieldSearch">
    <param name="field">user</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
          <param name="Username">
              <param name="fillOnEmpty">True</param>
            <param name="value">*</param>
          </param>
      </param>
    </param>
    <param name="replacementMap">
      <param name="arg">
        <param name="Username">
            <param name="value">*</param>
        </param>
      </param>
    </param>

        <module name="HiddenSearch">
        <param name="search">index=proxy "$toreplace$"  </param>
                                    <module name="ConvertToIntention">
                                            <param name="settingToConvert">click.value2</param>
                                            <param name="intention">
                                                    <param name="name">stringreplace</param>
                                                    <param name="arg">
                                                            <param name="toreplace">
                                                                    <param name="value">$target$</param>
                                                            </param>
                                                    </param>
                                            </param>
                                            <module name="ViewRedirector">
                                                    <param name="viewTarget">flashtimeline</param>
                                            </module>
                                    </module>
                            </module>

        </module>
        <module name="ViewRedirectorLink">
          <param name="viewTarget">flashtimeline</param>

0 Karma

Lucas_K
Motivator

There is an existing thread here http://splunk-base.splunk.com/answers/58220/using-valuesetter-in-time-parameter that passes the existing time plus a relative time value to a click through search.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...