I have a single value panel that shows me the number of events by user. I want to create a drilldown when I click on the single value that displays a new panel in table format and lists the users and other details. I created a token, but I can't seem to get it to pull any user information.
<panel>
<title>Users Deleted (last 30 days)</title>
<single>
<search>
<query>index=windows sourcetype="wineventlog" source="wineventlog:security" EventCode="4726" NOT User="*$" | stats dc(user) AS "User Events"</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<option name="drilldown">all</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="USER">$row.user$</set>
</drilldown>
</single>
</panel>
</row>
<row>
<panel depends="$USER$">
<title>User Details</title>
<table>
<search>
<query>index=windows sourcetype="wineventlog" source="wineventlog:security" user="$USER$" | table user</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</dashboard>
@MarcoG17- Your first query should be
stats dc(user) AS "User Events" by User| fields "User Events" , User
this displays the users instead of the number in the single value panel. Not working as i would imagine.
@MarcoG17
Your field name in search is User Events
and you are trying to set the token to user
i.e. stats dc(user) AS "User Events"
vs $row.user$
Try changing the search to
stats dc(user) AS user
makes sense i did what you said but when i click on the single value number it still doesn't show the user name in the table.
@MarcoG17,
Click on the search icon under the table panel and see what search it has executed. This would help us to find what value is passed and why no result is retrieved for that user.