Dashboards & Visualizations

How to drilldown link to compose a message passed the clicked value to the recipient field

johnward4
Communicator

I have a dashboard for my ticketing system. Main panel shows a Timechart span=1mon for tickets by category (past 6 months). I have a drilldown panel to show me the top users for each category within the month you select.

In this drilldown panel, I have a table that shows .... User, Manager_Email, Count

I'm asking how can I add a drilldown on the Manager_Email field to send an email passing this field value as the recipient. Extra would be to Add a default subject line and pass the User field there, e.g. $selectUser$ has generated $selectCount$ tickets for $selectCategoryName$.

Main Panel Query :

index=ticketsys TicketID=* sourcetype="tickets"
| dedup TicketID 
| timechart span=1mon count by CategoryName useother=f usenull=f

Drilldown to Top Users by User for Month :

index=ticketsys TicketID=* CategoryName="$selectCatName$" sourcetype="tickets"  
| eval srchMonth=strftime(_time,"%m") 
| search srchMonth=$selectTime$
| dedup TicketID 
| stats count by CategoryName, contact, ManagerUsername
| strcat ManagerUsername "@gmail.com" Manager_Email
| rename contact as Requester 
| head 10
| table CategoryName, Requester, Manager_Email, count
| sort - count
0 Karma

renjith_nair
Legend

@johnward4,
You shall try using drilldown 'search' to send a mail using sendmail command if that works for you.

Select drilldown from the table and link to search. use custom search and use the tokens inside

|makeresults| sendemail to=example@splunk.com server=mail.example.com subject="Information about ticket count generated by $selectUser$" message=" $selectUser$ has generated $selectCount$ tickets for $selectCategoryName$."

http://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/DrilldownLinkToSearch

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...