Refine your search:

1
1

I have a summary indexing job that summarizes the following

Top IP's hitting my website over a 5m period.

I have a piechart on my dashboard that runs a search against that summary index, but it looks for "Top IP's hitting my website over a 30day period". Perfect usecase for Summary Indexing.

Now, i'd like to be able to click on one of the pie chart elements and have it display the actual raw data, and not the summary indexing results.

How can i do that?

asked 04 Dec '10, 16:21

Michael%20Wilde's gravatar image

Michael Wilde ♦
33528
accept rate: 64%


One Answer:

You can do this with something like this:

<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="true">
    <param name="search">index=summary report=top_client_ips | top clientip</param>
    <module name="HiddenChartFormatter">
        <param name="charting.chart">pie</param>
        <module name="FlashChart">
            <param name="height">250px</param>
            <param name="enableResize">false</param>
            <module name="HiddenSearch">
                <param name="search">sourcetype=access_combined clientip=$clientip$</param>
                <param name="earliest">-30d@d</param>
                <module name="ConvertToIntention">
                    <param name="settingToConvert">click.value</param>
                    <param name="intention">
                        <param name="name">stringreplace</param>
                        <param name="arg">
                            <param name="clientip">
                                <param name="value">$target$</param>
                            </param>
                        </param>
                    </param>
                    <module name="ViewRedirector">
                        <param name="viewTarget">flashtimeline</param>
                    </module>
                </module>
            </module>
        </module>
    </module>
</module>

The inner HiddenSearch is the search that is getting populated with the argument from the clicked area.

link

answered 04 Dec '10, 16:58

ziegfried's gravatar image

ziegfried ♦
7.2k1315
accept rate: 53%

edited 04 Dec '10, 18:14

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×325
×194
×150

Asked: 04 Dec '10, 16:21

Seen: 880 times

Last updated: 15 Jan '11, 21:22

Copyright © 2005-2012 Splunk, Inc. All rights reserved.