Newbie: How to create a variable out of multiple fields before passing it to link tag?

[jalau9]

Hi, I'm trying to build HTML links inside a drilldown tag, but that link is quite complex as it uses a few fields in a row. How do I first create the string before putting it into the section? I guess I should use eval but how do I put it into the link tag? This dashboard has multiple tables, but this link only applies to this table.

<row>
<table>
<searchString>index=all | stats count a b c</searchString>
<drilldown target="_blank">
<link field="field1">http:my_url/(complex string)/field1/field2.html</link>
</drilldown>
</table>
</row>

How do I create an eval variable that I pass to link? Sorry if this is so newbie, it's such a simple thing but I don't know how to do it in Splunk.

[helenashton]

Hi,

You could use an eval to create your link
i.e.

<searchString>index=all | stats count a b c | eval mylink=a+"/"+b+"/"+c+".html"</searchString>

but I think you might run into problems with the slashes getting encoded.

It's just as simple to put your link info in the link tag as it is in the eval.
i.e.

  <drilldown target="_blank">
        <link>http://myurl/$row.a$/$row.b$/$row.c$.html</link>
  </drilldown>

You can also use hidden fields in your URL I believe.
Check the following link for the different options on grabbing clickable values/columns etc.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/Understandbasictableandchartdrilldownactions#D...

Hope this helps.

[MuS]

Did you check the docs about dynamic drill downs http://docs.splunk.com/Documentation/Splunk/latest/Viz/Dynamicdrilldownindashboardsandforms or token usage in dashboards http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens ?

[jalau9]

I don't mean event tokens like click.value, row.. It is a complex string, made up of substr, concatenation and replace functions. Are these functions doable inside the link tag? HTML is not something I've mastered, so please be patient.

[helenashton]

Ah! I didn't appreciate that from your example. You certainly can.

For a list of the eval functions check out http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonEvalFunctions

My example showed a simple eval, but you can do all sorts.
You mentioned replace...
eval myLink=replace(a,"bob","mary")

You don't need any HTML knowledge here, just explore eval.