Passing contextual value while opening Splunk Classic Dashboard drilldown in new window

[siddharthad]

I am new to Splunk, so my question maybe very basic. I have built a Splunk dashboard using classic option. I have some Statistics Table and Line Chart in there. The drilldown works great if configured as "Link to search" and Auto which opens in the same window. But I want it to open in a new window. When I try to configure for Custom, I see the following screen

But it doesn't open the relevant record/log which I am clicking. 

Below is the decoded url when I configure drilldown as Auto (when it works)

https://splunk.wellsfargo.net/en-US/app/wf-s-eft/search?q=search index=**** wf_id=*** source="****" <other search condition> | search Dataset="DS1" | rename ToatalProcessTime AS "Processing Time", TotalRecordsSaved AS "Record Saved", WorkFlow AS Integration &earliest=1716004800.000&latest=1716091200&sid=1716232362.2348555_113378B4-9E44-4B5A-BDBA-831A6E059142&display.page.search.mode=fast&dispatch.sample_ratio=1

I have edited the url for privacy:

<other search condition>: Extended search condition

Below are the search conditions injected by Splunk:

search Dataset="DS1" - where DS1 is the dataset which I clicked

earliest=1716004800.000&latest=1716091200 - these are the 2 values sent based on the click

How can I pass these values while configuring Custom drilldown to open in a new window. 

Thanks in advance!

Sid

[gcusello]

Hi @siddharthad,

in the drilldown link, you have to pass all the fields (in the ones that you have in your results) that are useful to identify the events to display in the drilldown dashboard.

Put attention that you can pass only the fields in your main search, e.g. if you have a | table _tima, Name host, the only fields that you can pass are _time, Name and host.

If you need to pass other fields that you don't want to display in the main dashboard, you can add them to the search and list the fields to display in the <fields></fields> tag.

Ciao.

Giuseppe