topic How to pass the username of a logged in user to a drilldown link? in Dashboards & Visualizations

How to pass the username of a logged in user to a drilldown link?

cse9423 — Thu, 01 Oct 2015 04:10:19 GMT

Hello,

I want to pass logged-in user name in a drilldown link. I have a search to fetch the logged-in user, but I don't know how to pass in a drilldown.

<panel>
  <table>
    <title>result </title>
    <search>
      <query> index=main sourcetype=log2 | table field1, field2 </query>
    </search>
    <drilldown target="Status">
      <link>http://mylink?value=$click.value$&username=???????need to pass logged-in user name????????</link>
    </drilldown>         
  </table>
</panel>

This search provides the logged-in user:

<query> | rest splunk_server=local /services/authentication/current-context | table username </query>

Re: How to pass the username of a logged in user to a drilldown link?

tom_frotscher — Thu, 01 Oct 2015 07:30:57 GMT

Hi,

$click.value$ is the leftmost value of your table. $click.value2$ is the value you clicked on. You can also use $row.fieldname$ , where fieldname is the column of your table you want the value from.

So in your case try it with $row.username$

Greetings

Tom

Re: How to pass the username of a logged in user to a drilldown link?

cse9423 — Thu, 01 Oct 2015 13:23:22 GMT

Tom, Thanks for your reply. Somehow it doesn't work for me. This is how i have.

  <panel>
  <table>
    <title>User current</title>
    <search>
      <query> | rest splunk_server=local /services/authentication/current-context | table username </query>
    </search>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="drilldown">cell</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
  </table>
</panel>



<panel>
  <table>
    <title>function</title>
    <search>
      <query> index=main sourcetype=log | table field1, field2 </query>
    </search>
    <drilldown target="new window">
      <link>http://www.site1.com?valuefield=$click.value$&amp;loguser=$row.username$</link>
    </drilldown>         
  </table>
</panel>

Re: How to pass the username of a logged in user to a drilldown link?

somesoni2 — Thu, 01 Oct 2015 14:39:45 GMT

You can achieve it like this (will work on any splunk instance)

Steps done:
1) Added a field called username to all the rows of the table using current user query.
2) Used fields tag to specify what columns will be displayed on table (basically remove username from display). The hidden field will still be available with token $row.fieldname$
3) updated to drilldown to use username from the table rows.

<dashboard>
  <label>tobedeleted</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| tstats min(_time) as _time WHERE index=_* by sourcetype | eval username=[| rest splunk_server=local /services/authentication/current-context | table username | eval username="\"".username."\"" | return $username]</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">10</option>
        <drilldown target="new window">
          <link>http://www.google.com?loguser=$row.username$&amp;valuefield=$click.value$</link>
        </drilldown>
        <fields>["sourcetype","_time"]</fields>
      </table>
    </panel>
  </row>
</dashboard>

Re: How to pass the username of a logged in user to a drilldown link?

cse9423 — Thu, 01 Oct 2015 19:58:21 GMT

Thanks. This works.