Dashboard drilldown conditions

[klaudiac]

Hi folks, 

Quick question, but I'm running out of ideas.

I have a dashboard where I compare results between US and EU, one of the filters is "side" where I differentiate between EU and US. 

When I select EU results, I'd like to be able to click on a result and it'll open up a new window with details of how that result was achieved (it's from another website)
Same scenario  for when i click on the Side=NA, it leads me to a different website.

I tried this, but as far as the EU part work, the US does not... 

<drilldown>
<condition match="$side$ = EU"></condition>
<condition>
<link target="_blank">/app/SplunkEnterpriseSecuritySuite/correlation_search_edit?search=$row.rule_name$</link>
</condition>

<condition match="$side$ = US"></condition>
<condition>
<link target="_blank">www.youtube.com</link>
</condition>
</drilldown>

Any hints or ideas? 

Thanks, 

Klaudia 

[bowesmana · Accepted solution]

@klaudiac 

You condition statements don't make sense. You have 4 conditions there, two are empty, i.e. 

<condition match="$side$ = EU"></condition>

does not do anything, so all you have there is a single drilldown, which will most likely be the first one Splunk comes across, i.e. the link to the ES correlation search edit

 Try this - note the " values before and after the EU/ES, as they should be quoted for string matching.

<drilldown>
  <condition match="$side$ = &quot;EU&quot;">
    <link target="_blank">/app/SplunkEnterpriseSecuritySuite/correlation_search_edit?search=$row.rule_name$</link>
  </condition>
  <condition match="$side$ = &quot;US&quot;">
    <link target="_blank">www.youtube.com</link>
  </condition>
</drilldown>

[klaudiac]

That worked, thanks so much! 

[to4kawa]

https://docs.splunk.com/Documentation/Splunk/8.1.1/Viz/DrilldownLinkToURL

where is the protocol identifier?