- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi folks,
Quick question, but I'm running out of ideas.
I have a dashboard where I compare results between US and EU, one of the filters is "side" where I differentiate between EU and US.
When I select EU results, I'd like to be able to click on a result and it'll open up a new window with details of how that result was achieved (it's from another website)
Same scenario for when i click on the Side=NA, it leads me to a different website.
I tried this, but as far as the EU part work, the US does not...
<drilldown>
<condition match="$side$ = EU"></condition>
<condition>
<link target="_blank">/app/SplunkEnterpriseSecuritySuite/correlation_search_edit?search=$row.rule_name$</link>
</condition>
<condition match="$side$ = US"></condition>
<condition>
<link target="_blank">www.youtube.com</link>
</condition>
</drilldown>
Any hints or ideas?
Thanks,
Klaudia
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You condition statements don't make sense. You have 4 conditions there, two are empty, i.e.
<condition match="$side$ = EU"></condition>
does not do anything, so all you have there is a single drilldown, which will most likely be the first one Splunk comes across, i.e. the link to the ES correlation search edit
Try this - note the " values before and after the EU/ES, as they should be quoted for string matching.
<drilldown>
<condition match="$side$ = "EU"">
<link target="_blank">/app/SplunkEnterpriseSecuritySuite/correlation_search_edit?search=$row.rule_name$</link>
</condition>
<condition match="$side$ = "US"">
<link target="_blank">www.youtube.com</link>
</condition>
</drilldown>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You condition statements don't make sense. You have 4 conditions there, two are empty, i.e.
<condition match="$side$ = EU"></condition>
does not do anything, so all you have there is a single drilldown, which will most likely be the first one Splunk comes across, i.e. the link to the ES correlation search edit
Try this - note the " values before and after the EU/ES, as they should be quoted for string matching.
<drilldown>
<condition match="$side$ = "EU"">
<link target="_blank">/app/SplunkEnterpriseSecuritySuite/correlation_search_edit?search=$row.rule_name$</link>
</condition>
<condition match="$side$ = "US"">
<link target="_blank">www.youtube.com</link>
</condition>
</drilldown>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That worked, thanks so much!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
https://docs.splunk.com/Documentation/Splunk/8.1.1/Viz/DrilldownLinkToURL
where is the protocol identifier?
