Dashboards & Visualizations

How to drilldown link to compose a message passed the clicked value to the recipient field


I have a dashboard for my ticketing system. Main panel shows a Timechart span=1mon for tickets by category (past 6 months). I have a drilldown panel to show me the top users for each category within the month you select.

In this drilldown panel, I have a table that shows .... User, Manager_Email, Count

I'm asking how can I add a drilldown on the Manager_Email field to send an email passing this field value as the recipient. Extra would be to Add a default subject line and pass the User field there, e.g. $selectUser$ has generated $selectCount$ tickets for $selectCategoryName$.

Main Panel Query :

index=ticketsys TicketID=* sourcetype="tickets"
| dedup TicketID 
| timechart span=1mon count by CategoryName useother=f usenull=f

Drilldown to Top Users by User for Month :

index=ticketsys TicketID=* CategoryName="$selectCatName$" sourcetype="tickets"  
| eval srchMonth=strftime(_time,"%m") 
| search srchMonth=$selectTime$
| dedup TicketID 
| stats count by CategoryName, contact, ManagerUsername
| strcat ManagerUsername "@gmail.com" Manager_Email
| rename contact as Requester 
| head 10
| table CategoryName, Requester, Manager_Email, count
| sort - count
0 Karma

Re: How to drilldown link to compose a message passed the clicked value to the recipient field


You shall try using drilldown 'search' to send a mail using sendmail command if that works for you.

Select drilldown from the table and link to search. use custom search and use the tokens inside

|makeresults| sendemail to=example@splunk.com server=mail.example.com subject="Information about ticket count generated by $selectUser$" message=" $selectUser$ has generated $selectCount$ tickets for $selectCategoryName$."


0 Karma