I am looking for a way to create a custom drill down menu option from the Event tab on a specific field value. The example is shown below. When the user clicks on the ExecutionID field value I would like to add a menu option to "View Execution Error" that would run a dbxquery passing in the ExecutionID value. Is this possible and if so can you send me instructions on how.
Not sure you can add custom drilldowns from just a search, but you could do this in a dashboard easily. There are examples in the doc here: http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/DrilldownIntro
You might do it with 2 Dashboards:
The query on the second dashboard might look like:
| dbxquery connection=some_db query="select * from some_table where execution_id = $exec_id_tok$ "