I have a dashboard for my ticketing system. Main panel shows a Timechart span=1mon for tickets by category (past 6 months). I have a drilldown panel to show me the top users for each category within the month you select.
In this drilldown panel, I have a table that shows .... User, Manager_Email, Count
I'm asking how can I add a drilldown on the Manager_Email field to send an email passing this field value as the recipient. Extra would be to Add a default subject line and pass the User field there, e.g. $selectUser$ has generated $selectCount$ tickets for $selectCategoryName$.
Main Panel Query :
index=ticketsys TicketID=* sourcetype="tickets"
| dedup TicketID
| timechart span=1mon count by CategoryName useother=f usenull=f
Drilldown to Top Users by User for Month :
index=ticketsys TicketID=* CategoryName="$selectCatName$" sourcetype="tickets"
| eval srchMonth=strftime(_time,"%m")
| search srchMonth=$selectTime$
| dedup TicketID
| stats count by CategoryName, contact, ManagerUsername
| strcat ManagerUsername "@gmail.com" Manager_Email
| rename contact as Requester
| head 10
| table CategoryName, Requester, Manager_Email, count
| sort - count
@johnward4,
You shall try using drilldown 'search' to send a mail using sendmail
command if that works for you.
Select drilldown from the table and link to search
. use custom search and use the tokens inside
|makeresults| sendemail to=example@splunk.com server=mail.example.com subject="Information about ticket count generated by $selectUser$" message=" $selectUser$ has generated $selectCount$ tickets for $selectCategoryName$."
http://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/DrilldownLinkToSearch