Dashboards & Visualizations

How to pass the username of a logged in user to a drilldown link?

cse9423
Explorer

Hello,

I want to pass logged-in user name in a drilldown link. I have a search to fetch the logged-in user, but I don't know how to pass in a drilldown.

<panel>
  <table>
    <title>result </title>
    <search>
      <query> index=main sourcetype=log2 | table field1, field2 </query>
    </search>
    <drilldown target="Status">
      <link>http://mylink?value=$click.value$&username=???????need to pass logged-in user name????????</link>
    </drilldown>         
  </table>
</panel>

This search provides the logged-in user:

<query> | rest splunk_server=local /services/authentication/current-context | table username </query>
0 Karma
1 Solution

somesoni2
Revered Legend

You can achieve it like this (will work on any splunk instance)

Steps done:
1) Added a field called username to all the rows of the table using current user query.
2) Used fields tag to specify what columns will be displayed on table (basically remove username from display). The hidden field will still be available with token $row.fieldname$
3) updated to drilldown to use username from the table rows.

<dashboard>
  <label>tobedeleted</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| tstats min(_time) as _time WHERE index=_* by sourcetype | eval username=[| rest splunk_server=local /services/authentication/current-context | table username | eval username="\"".username."\"" | return $username]</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">10</option>
        <drilldown target="new window">
          <link>http://www.google.com?loguser=$row.username$&amp;valuefield=$click.value$</link>
        </drilldown>
        <fields>["sourcetype","_time"]</fields>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

somesoni2
Revered Legend

You can achieve it like this (will work on any splunk instance)

Steps done:
1) Added a field called username to all the rows of the table using current user query.
2) Used fields tag to specify what columns will be displayed on table (basically remove username from display). The hidden field will still be available with token $row.fieldname$
3) updated to drilldown to use username from the table rows.

<dashboard>
  <label>tobedeleted</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| tstats min(_time) as _time WHERE index=_* by sourcetype | eval username=[| rest splunk_server=local /services/authentication/current-context | table username | eval username="\"".username."\"" | return $username]</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">10</option>
        <drilldown target="new window">
          <link>http://www.google.com?loguser=$row.username$&amp;valuefield=$click.value$</link>
        </drilldown>
        <fields>["sourcetype","_time"]</fields>
      </table>
    </panel>
  </row>
</dashboard>

cse9423
Explorer

Thanks. This works.

0 Karma

tom_frotscher
Builder

Hi,

$click.value$ is the leftmost value of your table. $click.value2$ is the value you clicked on. You can also use $row.fieldname$, where fieldname is the column of your table you want the value from.

So in your case try it with $row.username$

Greetings

Tom

cse9423
Explorer

Tom, Thanks for your reply. Somehow it doesn't work for me. This is how i have.

  <panel>
  <table>
    <title>User current</title>
    <search>
      <query> | rest splunk_server=local /services/authentication/current-context | table username </query>
    </search>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="drilldown">cell</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
  </table>
</panel>



<panel>
  <table>
    <title>function</title>
    <search>
      <query> index=main sourcetype=log | table field1, field2 </query>
    </search>
    <drilldown target="new window">
      <link>http://www.site1.com?valuefield=$click.value$&amp;loguser=$row.username$</link>
    </drilldown>         
  </table>
</panel>
0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...