Drilldown to Show Source

[rwardwell]

Hello All,
I have a usecase to generate a drill down from a dashboard to the "Show Source" view. I am able to open a new tab that is the show source view but it is not populated. I think I need to try and pass the sid to the show source view. I tried to do this by setting a token to equal the job.sid. However, this token has a bunch of other data such as username etc and doesn't work. Does anyone have experience linking to show source and if so how did you do it?

Thanks!

[ak9092]

Hi @rwardwell ,

Have you had any luck in achieving this ? If yes, then can you please share your inputs as I am struggling with the same.

[niketn]

@rwardwell @ak9092 how about something like this? You have to ensure that Dashboard search for drilldown has raw events only using purely streaming command.

<dashboard>
  <label>Table with Show Source Drilldown</label>
  <search>
    <query>| makeresults
    | eval app="$env:app$"</query>
    <done>
      <set token="app">$result.app$</set>
    </done>
  </search>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <set token="sid">$job.sid$</set>
          </done>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| fields _time log_level _raw
| head 50</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">http://localhost:8000/en-US/app/$app$/show_source?sid=$sid|n$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>