How to pass $env:user$ to a Drilldown URL ()?

[avoidingthesubj]

anybody know if its possible to pass $env:user$ to a drilldown with link?
i.e: ssh://$env:user$@$click.value2$
I cant seem to access global token using link no matter what I try...

URL ends up being
ssh://$env:user$@host.com

should be:
ssh://john@host.com

[kamlesh_vaghela · Accepted solution]

@avoidingthesubject,

I'm also not able to access Global tokens directly into drilldown url. But I can access it in search. You can achieve the same by using adding the column in the table.

Can you please try following xml?

<dashboard>
  <row>
    <panel>
      <table>
        <search> 
          <query> | makeresults | eval emailId="$env:user$@gmail.com"</query>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
           <link>
             /app/search/search?q=$row.emailId$
           </link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

[avoidingthesubj]

That worked really nicely! Great work!

[kamlesh_vaghela]

@avoidingthesubject,

Glad to help you. Can you please accept the answer to close this question?

[avoidingthesubj]

Only thing is I can't seem to remove the column from the table without breaking the link.

| fields - emailId

any ideas?

[niketn]

@avoidingthesubject if you do not wish to show email id in the table but still use the email ID in the drilldown following are your two options:

Option 1) Run an independent search to create a global token for your dashboard to be used in any drilldown without showing the email ID

     <search> 
       <query> | makeresults 
 | fields - _time
 | eval emailId="$env:user$@gmail.com"
        <done>
             <eval token="tokLoggedInUserEmail">$result.emailId$@gmail.com</eval>
        </done>
     </search>

Then use $tokLoggedInUserEmail$ later in your actual drilldown.

Option 2) In the above example use <fields> tag in the <table> to show only the fields you are interested in and hide the remaining i.e. emailId. This way email id will not be shown in the front-end but it will be available for drilldown. An example of this approach of hidden fields for drilldown is available in the Splunk Dashboard Examples app.

Following is a mock example which shows that if you have table with fields field1, field2, field3 and emailId. You can use <fields> to show only field1, field2 and field3 while emailId will be avaiable for drilldown without being displayed in the table. Kindly replace with your existing search and fields accordingly.

   <table>
     <search> 
       <query> <yourSearchReturningRequiredFields>
 | eval emailId="$env:user$@gmail.com"
 | table field1 field2 field3 emailId</query>
     </search>
     <fields>field1, field2, field3</fields>
     <option name="drilldown">row</option>
     <drilldown>
        <link>
          /app/search/search?q=$row.emailId$
        </link>
     </drilldown>
   </table>