topic Re: How to pass a field value to a "Link to search" SPL query from a Dashboard table? in Splunk Search

How to pass a field value to a "Link to search" SPL query from a Dashboard table?

tdavison76 — Mon, 02 Dec 2024 14:50:13 GMT

Hello,

I need help on passing a field value from a Dashboard table into a "Link to search" drilldown but can't figure it out.

I have a table that contains a "host" field. I am needing to be able to click on any of the returned hosts and drill into all of the events for that host.

I've tried in hopes that the $host$ would be replaced with the actual host name with this drilldown query:

source="udp:514" host="$host$.doman.com"

but, of course failed, it just get's replaced with "*".

I'm sure I'm probably way off on how to do this, but any help would be awesome. 🙂

Thanks in advance.

Tom

Re: How to pass a field value to a "Link to search" SPL query from a Dashboard table?

richgalloway — Mon, 02 Dec 2024 15:32:37 GMT

Use $results.host$

Re: How to pass a field value to a "Link to search" SPL query from a Dashboard table?

dural_yyz — Mon, 02 Dec 2024 15:45:17 GMT

Re: How to pass a field value to a "Link to search" SPL query from a Dashboard table?

richgalloway — Mon, 02 Dec 2024 16:16:18 GMT

This is a better answer than mine. $results$ will only pick up the first result rather than the row clicked.

Re: How to pass a field value to a "Link to search" SPL query from a Dashboard table?

tdavison76 — Mon, 02 Dec 2024 16:16:52 GMT

Hey guys,

Thanks for the quick help, still stuck for some reason. So I've tried $row.host$ and $result.host$ but they both result in just passing $xxx.host$ for some reason. Here's the config:

Here's the resulting search:

Here's the table query:

And, here's a screenshot of the table if helpful. 🙂

Thanks again for the help on this one, very much appreciated.

Tom

Re: How to pass a field value to a "Link to search" SPL query from a Dashboard table?

dural_yyz — Mon, 02 Dec 2024 16:26:57 GMT

Ok so we know row and results works in other environments. Something should be there based upon what we have seen from your SPL and table results. I would recommend saving the updated drill down, then log out of splunk, close browser and clear cache/cookies, log into splunk, and reload dashboards.

Re: How to pass a field value to a "Link to search" SPL query from a Dashboard table?

tdavison76 — Mon, 02 Dec 2024 16:45:18 GMT

Thanks, I tried the steps, but same thing occurred. I then quickly set up a Classic Dashboard instead of a Dashboard Studio, and it works. Looks like either an issue with Studio, of maybe it's just done differently. 🙂

Thanks again,

Tom

Re: How to pass a field value to a "Link to search" SPL query from a Dashboard table?

dural_yyz — Mon, 02 Dec 2024 18:56:45 GMT

I had assumed you were doing Classic XML to start, Dashboard Studio is slightly different I can try testing later.

Re: How to pass a field value to a "Link to search" SPL query from a Dashboard table?

tdavison76 — Mon, 02 Dec 2024 19:55:17 GMT

Sorry about that, I didn't think it would matter. Looks like it does. I've created a Support ticket for this as well. Hopefully, they'll get back to me. If they do, I'll let you know the solution with Studio. 🙂

Thanks again,

Tom

Re: How to pass a field value to a "Link to search" SPL query from a Dashboard table?

richgalloway — Mon, 02 Dec 2024 20:23:40 GMT

In Dashboard Studio it's $row.<<fieldname>>.value$.

$row.host.value$