anybody know if its possible to pass $env:user$ to a drilldown with link?
i.e: ssh://$env:user$@$click.value2$
I cant seem to access global token using link no matter what I try...
URL ends up being
ssh://$env:user$@host.com
should be:
ssh://john@host.com
@avoidingthesubject,
I'm also not able to access Global tokens directly into drilldown url. But I can access it in search. You can achieve the same by using adding the column in the table.
Can you please try following xml?
<dashboard>
<row>
<panel>
<table>
<search>
<query> | makeresults | eval emailId="$env:user$@gmail.com"</query>
</search>
<option name="drilldown">row</option>
<drilldown>
<link>
/app/search/search?q=$row.emailId$
</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>
@avoidingthesubject,
I'm also not able to access Global tokens directly into drilldown url. But I can access it in search. You can achieve the same by using adding the column in the table.
Can you please try following xml?
<dashboard>
<row>
<panel>
<table>
<search>
<query> | makeresults | eval emailId="$env:user$@gmail.com"</query>
</search>
<option name="drilldown">row</option>
<drilldown>
<link>
/app/search/search?q=$row.emailId$
</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>
That worked really nicely! Great work!
@avoidingthesubject,
Glad to help you. Can you please accept the answer to close this question?
Only thing is I can't seem to remove the column from the table without breaking the link.
| fields - emailId
any ideas?
@avoidingthesubject if you do not wish to show email id in the table but still use the email ID in the drilldown following are your two options:
Option 1) Run an independent search to create a global token for your dashboard to be used in any drilldown without showing the email ID
<search>
<query> | makeresults
| fields - _time
| eval emailId="$env:user$@gmail.com"
<done>
<eval token="tokLoggedInUserEmail">$result.emailId$@gmail.com</eval>
</done>
</search>
Then use $tokLoggedInUserEmail$
later in your actual drilldown.
Option 2) In the above example use <fields>
tag in the <table>
to show only the fields you are interested in and hide the remaining i.e. emailId
. This way email id will not be shown in the front-end but it will be available for drilldown. An example of this approach of hidden fields for drilldown is available in the Splunk Dashboard Examples app.
Following is a mock example which shows that if you have table with fields field1, field2, field3 and emailId. You can use <fields>
to show only field1, field2 and field3 while emailId
will be avaiable for drilldown without being displayed in the table. Kindly replace with your existing search and fields accordingly.
<table>
<search>
<query> <yourSearchReturningRequiredFields>
| eval emailId="$env:user$@gmail.com"
| table field1 field2 field3 emailId</query>
</search>
<fields>field1, field2, field3</fields>
<option name="drilldown">row</option>
<drilldown>
<link>
/app/search/search?q=$row.emailId$
</link>
</drilldown>
</table>