Dashboards & Visualizations

Question about adding new time to search around events based on "parent"-search in sub/ child -search

lmyrefelt
Builder

Hi, I would like to know if it is possible to do the following;

I am trying to create a dashboard allowing our networking and help-desk team to search for user activity. They will first be presented with the option of the time frame to search for, after this they will have to put in a username or * to search for.

This will then give them back a table with username and some other fields. All the fields in this table is then selectable to do another search. However this sub-search returns all events that contains the selected field for the above selected time frame, lets say last 30 days.
However what i would like to do is to allow the people to select the username and time, for example 30 days to search for, than have them to select one of the fields from the results and do another search based on that field in a "new" with a new time set like 30 mins AROUND / or at least present me / us with the results 30 mins around this event from witch the field they chose existed. Not the whole 30days until now.

Did i make myself understandable ? 😛

The dashboard / searches ( interesting part ) comes here;

module name="Message" layoutPanel="messaging">
splunk.search.job
True
1


dashboard


index=blah user="$Username$" | table something, something, something
Network blah activity

<module name="TimeRangePicker">
    <param name="default">Last 15 minutes</param>
    <param name="searchWhenChanged">False</param>

  <module name="ExtendedFieldSearch">
    <param name="field">user</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
          <param name="Username">
              <param name="fillOnEmpty">True</param>
            <param name="value">*</param>
          </param>
      </param>
    </param>
    <param name="replacementMap">
      <param name="arg">
        <param name="Username">
            <param name="value">*</param>
        </param>
      </param>
    </param>

        <module name="HiddenSearch">
        <param name="search">index=proxy "$toreplace$"  </param>
                                    <module name="ConvertToIntention">
                                            <param name="settingToConvert">click.value2</param>
                                            <param name="intention">
                                                    <param name="name">stringreplace</param>
                                                    <param name="arg">
                                                            <param name="toreplace">
                                                                    <param name="value">$target$</param>
                                                            </param>
                                                    </param>
                                            </param>
                                            <module name="ViewRedirector">
                                                    <param name="viewTarget">flashtimeline</param>
                                            </module>
                                    </module>
                            </module>

        </module>
        <module name="ViewRedirectorLink">
          <param name="viewTarget">flashtimeline</param>

0 Karma

Lucas_K
Motivator

There is an existing thread here http://splunk-base.splunk.com/answers/58220/using-valuesetter-in-time-parameter that passes the existing time plus a relative time value to a click through search.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...