How to pass 2 different click.values when we use 'Link to search' drilldown method ?

georgear7 — Fri, 19 Jun 2020 06:29:43 GMT

I have below source code. My aim is to pass 2 click values(click.value & click.value2) to my search by using 'Link to search' drilldown method.
I have used 'time' dropdwon filter here. and below is my drilldown source code.

<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">search?q=index=index_foo%20source=*$click.value2$*restart.log&earliest=$time.earliest$&latest=$time.latest$</link>
</drilldown>

Output of my Main dashboard search:

Req JVM status
1732 App1 started
1732 App2 stopped
2747 App1 stopped

Actual source name is something like, 1732/App1_restart.log.
So if i click, App1 in the table after setting up drilldown, it will give me all the log files whichever having App1 in it. This will be a problem when i set time as last 30 days or 7 days.

So i want to pass my Req as well to my search to get the exact log. My Req number is unique here.

Note:
JVM names will be same for all the time, but Req no will differ.

Re: How to pass 2 different click.values when we use 'Link to search' drilldown method ?

georgear7 — Wed, 08 Jul 2020 18:50:52 GMT

Hi @richgalloway , Need your input here.

topic How to pass 2 different click.values when we use 'Link to search' drilldown method ? in Splunk Enterprise

How to pass 2 different click.values when we use 'Link to search' drilldown method ?

Re: How to pass 2 different click.values when we use 'Link to search' drilldown method ?