topic How to create hyperlink that directs to search query on Splunk dashboard? in Splunk Search

How to create hyperlink that directs to search query on Splunk dashboard?

REACHGPRAVEEN — Tue, 26 Apr 2022 15:25:52 GMT

it should look like below 2

search by employeeid(hyperlink)

search by app(hyperlink)

once clicked on above hyperlinks it should open new search with search query

index = x | search employeeid =123

index= x | search app = abc

@scelikok @woodcock

Please help on this. Thanks in advance

Re: how to create hyperlink that directs to search query on splunk dashboard

tscroggins — Sat, 20 Feb 2021 19:12:08 GMT

@REACHGPRAVEEN

Assuming a base URL of https://splunk:8000/en-us/app/search, i.e. the search app on your Splunk search head, you can construct basic search URLs with the earliest, latest, and q query parameters:

https://splunk:8000/en-US/app/search/search?earliest=-24h%40h&latest=now&q=search%20index%3Dx%20employeeid%3D123

https://splunk:8000/en-US/app/search/search?earliest=-24h%40h&latest=now&q=search%20index%3Dx%20app%3Dabc

Basic URL encoding rules apply.

Re: how to create hyperlink that directs to search query on splunk dashboard

renoyzac — Tue, 26 Apr 2022 06:47:30 GMT

@tscroggins @REACHGPRAVEEN I'm facing a similar requirement. I tried appending my query to the q=search parameter as follows:

https://splunksearch.com/en-US/app/search/search? q=search index=xyz sourcetype=xyz

However, it only opens the Splunk Search window, the search query is not copy pasted in the search window.

Re: how to create hyperlink that directs to search query on splunk dashboard

ITWhisperer — Tue, 26 Apr 2022 06:55:38 GMT

The URL should be encoded e.g. spaces should be replaced by %20

https://splunksearch.com/en-US/app/search/search?q=search%20index=xyz%20sourcetype=xyz

Re: how to create hyperlink that directs to search query on splunk dashboard

renoyzac — Wed, 27 Apr 2022 07:10:30 GMT

That worked. Thank you 🙂