topic Re: How do I drilldown to a unique URL using a table row's unique token? in Splunk Enterprise Security

How do I drilldown to a unique URL using a table row's unique token?

jsven7 — Wed, 30 Sep 2020 04:48:52 GMT

Situation:

I have a panel. The panel creates a token for me from a field I extract from the search. In the same panel I create a URL that enables me to "drilldown".

Open Tickets

search...
| table "ticket_num", "Creation Date", "other_field", "other_field"

$field3.earliest$
$field3.latest$

$result.ticket_num$

5
none
row
true
```
       <eval>replace($row.url$, "http://", ""</eval>
       <link target="_blank">
         <![CDATA[ https://other.tool/$ticket_num$ ]]>
       </link>
     </drilldown>

  </table>
</panel>
```
My table appears to work nicely where each row represents unique open tickets.
Problem:
- All rows, upon clicking, "drilldown" only to the first row's "ticket_num". Which I think makes sense.
Question:
- Can you pleas share if its possible with ES simple XML and without any other add-on to modify the panel so that, upon clicking a row, I "drilldown" to the respective row's unique "ticket_num"?

Re: How do I drilldown to a unique URL using a table row's unique token?

memarshall63 — Thu, 02 Apr 2020 12:42:24 GMT

You'll likely need some form of this:

<drilldown>
  <link target="_blank">/app/some_app/some_dashboard?token=$click.value$&amp;token2=$row.fieldname$</link>
</drilldown>

https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/tokens

Re: How do I drilldown to a unique URL using a table row's unique token?

jsven7 — Fri, 03 Apr 2020 12:59:44 GMT

@memarshall63 - thanks so much for your time to write this comment. This led me down the right path! The below appears to create a unique URL per row that is clicked. Thanks so much.

            <link target="_blank">
              <![CDATA[ https://other.tool/$click.value$ ]]>
            </link>

Re: How do I drilldown to a unique URL using a table row's unique token?

memarshall63 — Fri, 03 Apr 2020 13:27:44 GMT

No problem. I believe $click.value$ will give you the field that is clicked. However, you may want to use a specific field regardless of where on the row the click occurs. When that occurs I think $row.$ is the choice for that behavior. At any rate... good luck.