topic Search results, link to url in Splunk Search

Search results, link to url

jgauthier — Mon, 14 Oct 2013 17:50:46 GMT

Greetings,

I've done some reading, but I can't seem to put together the various answers over the course of the years. I am using Splunk 5. I have a dashboard, and it has a dynamic drill down which then just calls a splunk query. I would really like to make that query some of the data (an id field) be a clickable link to an outside page. (ie: http://website.com/info?$id$).

How could I achieve this functionality?

Re: Search results, link to url

melting — Mon, 14 Oct 2013 18:12:10 GMT

There is some documentation on how to do this is simplexml:

Roughly if this a table you could do something like:

<table> ... <drilldown> <link>http://website.com/info?$row.id$). </drilldown> </table

Some other tokens available:
click.value2 - the value that you clicked on if you drilldown type is cell click.name1 - the fieldname that clicked on. click.value - the far left column's value click.name - the far left column's field name

Re: Search results, link to url

jgauthier — Mon, 14 Oct 2013 18:46:48 GMT

Thanks. I really wanted to do this from a search, but I did make another dashboard. The original dashboard drills down into the second supplying the form information, and then those rows are able to be drilled down. So mission accomplished!

Re: Search results, link to url

mcm10285 — Wed, 22 Jan 2014 08:09:54 GMT

Is this doable in advanced xml?

Re: Search results, link to url

qbolbk59 — Wed, 30 Jan 2019 12:53:40 GMT

Hi @melting_splunk ,

Does the tokens you specified, works for Bar chart dashboards as well ?

For e.g., i have a bar chart and i want to add a drill down "link to a search" and i wish to open a new search when i click on a bar of my graph. the new search should open results of the clicked value only. So what i tried to do is pass the variables using the token click.value. But it always opens a blank search.