topic Re: Clickable value in the output table in Splunk Search

Clickable value in the output table

vadlamudi — Wed, 20 Oct 2021 22:18:20 GMT

HI There,

Can i please know how make the REQUEST_ID clickable from the below query. i want pass the REQUEST_ID from query1 to query2 when the user clicks on the REQUEST_ID in table from query1.

Query 1:

index=<<index_name>> | dedup REQUEST_ID |
table USER_ID, ENTITY_TYPE, ENTITY_ID, REQUEST_ID, STATUS | where USER_ID="123123123"

Query 2:

Index=<<index_name>> "error" | where $REQUEST_ID$

Thank you

Re: Clickable value in the output table

Chef — Wed, 20 Oct 2021 22:49:34 GMT

Hi vadlamudi,

You can do this in a dashboard if you create a panel for each of those queries. Click "More actions" on the Query 1 table, select "edit drilldown" and then "Manage tokens on this dashboard".

Then you can just set the REQUEST_ID token to $row.REQUEST_ID$ and the second panel will automatically update with the users preferences.

Another option is to "Link to search" which will open a new window with the second query you specified, you can pass through the token the same way ($row.REQUEST_ID$).

Hope this helps!