Splunk DB Connect 1: How to create a drilldown link on a dashboard to a dbquery to show items within the clicked category?

New Member


I have a dashboard with categories and a count of each item in each category. I would like to click the category and create a drill down link to a DB Connect query that shows each item within that category rather than the category name and count of each item.

(e.g. XML Source see attached image)

I get the error:

Invalid view name requested: "| dbquery mon02 "SELECT * from usertasks"". View names may only contain alphanumeric characters.

I cannot get the proper syntax down when querying with DB Connect.

Any ideas?

Thanks in advance

0 Karma


Using simple XML, set tokens with the drilldown, and than open a new table or graphic with the new search using the query with the token:

Like this

index=main | table Offer Price
<set token="offer_token">$click.value$</set>

<table depends="$offer_token$">
| dbquery mon02 "select * from table where COD_OFFER=$offer_token$" | table id offer etc

The DEPENDS is only to hide your table when the token $offer_token$ is null.


You can't just put a raw query in the link tag. You need to put in a path. Have a look at the documentation and examples here:

Try copying the url you see when you run an actual search in the UI.

And for the token values you can use for your drill down see this section:

0 Karma