How could I custom the Link to search but still using the value from the clicked element?

[Jennifer]

Hi, all! 

I am want to custom the search command when I click the element but I don't know how to write the search using values from the clicked element like Auto function. 

For example, here's my dashboard and I hope that when I click on one of the Call_Session_ID, then it will jump to the search which combines the four different times with the same Call_Session_ID.

Thanks a lot for your help!

[SinghK]

You will need to create that search separately and save it as dashboard. Once done then edit the XML where the element is and add the link to the dashboard in XML.

<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">/app/your_app/details?Call_Session_ID=$row.Call_Session_ID$&amp;</link>
</drilldown>

[gcusello · Accepted solution]

Hi @Jennifer,

let me understand:

• you have a table that lists some values,
• clicking on one of these rows you want to open a new dashboard (or a new panel) with a different search (or the same) passing the clicked value to the search for filtering results;

is this correct?

If this is your need, I think that you should install on your Splunk machine the "Splunk Dashboard Examples " App (https://splunkbase.splunk.com/app/1603/) where you can find examples about how to do this.

in few words, if you want to open a new dashboard (called e.g. "details"), passing to it the clicked Call_Session_ID value, you could do somethiung like this:

In the main dashboard, add to the panel:

<option name="drilldown">cell</option>
<drilldown>
   <link target="_blank">/app/your_app/details?Call_Session_ID=$row.Call_Session_ID$&amp;</link>
</drilldown>

and in the secondary dashboard, add to the search the token $Call_Session_ID$:

your_search Call_Session_ID=$Call_Session_ID$
| ...

Ciao.

Giuseppe

[Jennifer]

Hi, Giuseppe!

Firstly, thanks so much for your help and I've solved this problem.  I just use the token of the click value in my custom search of drilldown!

Secondly I want to ask help with another issue:

How could I edit my search command in order to filter this table which will only display the first row of the same value(Call_Session_ID)? It means it will only show one Call_Session_ID with the earliest Time. 

Here is my original search command:

index="hkcivr" source="/appvol/wlp/DIVR01HK-AS01/applogs/progresshk.log*" $tttt$ $key$| table Time Call_Session_ID

[gcusello]

Hi @Jennifer,

good for you, please accept the answer for the other people of Community.

About the new question, next time it's better to open a new question.

But anyway, it's possible but only putting in a multivalue field all the values for the same Call_Session_ID, something like this:

index="hkcivr" source="/appvol/wlp/DIVR01HK-AS01/applogs/progresshk.log*" $tttt$ $key$
| stats values(Time) AS Time BY Call_Session_ID

 Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

[SinghK]

This needs to be updated xml :

<drilldown>
<link target="_self">/put in the link to which it needs to be redirected to</link>
</drilldown>

[johnhuang]

Do you want the clicked on token/value to run a search in the current dashboard or open a new tab to a different search/dashboard?

[Jennifer]

I hope to open a new tap and show the result which uses the selected element!