I use default search screen to see _raw such as
2017-10-26 12:41:59,787 [20 ]
----------------------------
requestID=Server&1509010919783-704536
messageID=Message@1509010919787-907822
actor=Agent->
ip=192.168.160.10
api=EncryptApi
method=DecryptFromUID
type=request
cardUID=7F006BE8
agent=breeze
How to decorate default search view to show "requestID=Server&1509010919783-704536" as hyperlink to dashboard
/payment?requestID=Server&1509010919783-704536
?
@exmuzzy, are you looking for Creating Workflow Action in Splunk: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/SetupaGETworkflowaction
You can use Get Workflow to open a Splunk Dashboard with query string(tokens) from _raw events using field name or event type.
@exmuzzy, are you looking for Creating Workflow Action in Splunk: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/SetupaGETworkflowaction
You can use Get Workflow to open a Splunk Dashboard with query string(tokens) from _raw events using field name or event type.
It's work!
@exmuzzy, glad it worked, I have converted to answer please accept to mark the question as answered 🙂