Good Morning,
I have created a simple dashboard that returns information on specific errors. The returned information are Time of event, Server, Sourcetype and event. I want to be able from the data returned, click on a value in the cell and it opens to that specific log information. I feel like I am close but I am really new to Splunk.
index=OH sourcetype=Buckeyes = Server1 source = /usr/local/ESP/Agent/spool/CDCDEV/MAIN/* "Exception text ORA00001: unique constraint" OR "fatal segments" OR "Maximum 91" OR "ORA01017: invalid username/password; logon denied" OR "Caused by: com.nf.nexus.batchx.workflow.WorkflowException: Error!!! job with name" OR "Unable to locate work flow implementation for es.link.batchx.nfs.control.processtask.monitor.recover.WorkflowImpl" OR "SEC049: Invalid Logon Attempt|Incorrect Password." dedup host, source |fields - _serial, _bkt, _cd, _indextime, _si, _subsecond, splunk_server, tag::host, _sourcetype |fields + _time, _raw, host, source | convert timeformat="%m-%d-%Y %l:%M:%S %p" ctime(_time) | eval _time=(substr(_time, 0, 11) + substr(_raw, 0, 8)) | eval source=substr(source,40) | rename _raw AS "Event", source AS "ESP Job", _time AS "Time", host AS "Server"
