topic help on link target token in Splunk Search

help on link target token

jip31 — Sun, 06 Mar 2022 06:22:25 GMT

hello

I open a new drilldown window from my dashboard like this

<drilldown> <link target="_blank">search?q=%60index_toto%60%20sourcetype%3D%22ez%3Acrash%22%20type%3D*%20%7C%20stats%20count%20as%20crash%20by%20host%20_time&earliest=-7d@h&latest=now</link></drilldown>

the exact search is

`index_toto` sourcetype="ez:crash" type=* | stats count as crash by host _time

I would like to add a token on the field host in order to display the results for this host in the new window results

could you help please?

Re: help on link target token

ITWhisperer — Sun, 06 Mar 2022 07:39:15 GMT

Depending what you are trying to do in your search query, try something like this

<drilldown> <link target="_blank">search?q=%60index_toto%60%20sourcetype%3D%22ez%3Acrash%22%20type%3D*%20host%3D%22$click.value$%22%20%7C%20stats%20count%20as%20crash%20by%20host%20_time&earliest=-7d@h&latest=now</link></drilldown>

Re: help on link target token

jip31 — Mon, 07 Mar 2022 06:26:46 GMT

ok perfect!