I have a dashboard panel configured to set a token called Tok_User to click.value2, and another token called temp_search that sets the the value to user=$Tok_User$
In another panel, I have an HTML button that opens ES incident review using the following URL format:
<html>
<style>.btn-primary { margin: 5px 10px 5px 0; }</style>
<a href="https://mysplunkurl:8000/en_us/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-7d@d&latest=now&form.status_form=*&form.owner_form=*&form.security_domain_form=*&form.srch=$temp_search$&form.selected_urgency=critical&form.selected_urgency=high&form.selected_urgency=medium&form.selected_urgency=low&form.selected_urgency=informational&form.source=A_Src_I_Want&form.source=Another_Src_I_Want& target="_blank" class="btn btn-primary">Review New Activity</a>
</html>
The sources fill in just fine, but in the search only "user" comes over, not user=<theclickvalue2username>
What am I missing to get this to transition properly?
