Use of to replace linkView

[seanmcl]

I apologize for the fact that a similar question was already answered but the answer was not clear. I'm porting some older code to 6.6 and link View is deprecated. The old (pseudo) code is:


<search>
<query>|inputlookup stats.csv|stats dc(Sources) as Sources</query>
<earliest>0</earliest>
</search>
<option name="drilldown">all</option>
...
<option name="linkView">search</option>


My question is what should be the correct syntax of the child elements for <drilldown> to achieve the same result? Presumably I would use the <link> element but <link>search</link> is clearly not correct. Again, my apologies for being so dense.

[renjith_nair]

@seanmcl,

You could use the search as option value of link

<drilldown>
    <link target="_blank">search?q=index=_internal | stats count by sourcetype</link>
</drilldown>

Please refer here for the syntax and usage : http://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/DrilldownLinkToSearch

[seanmcl]

Sorry about the poor formattting. The Markdown documentation was not clear that you needed to mark down every line of code rather than just the block.