Dashboards & Visualizations

Use of to replace linkView

seanmcl
New Member

I apologize for the fact that a similar question was already answered but the answer was not clear. I'm porting some older code to 6.6 and link View is deprecated. The old (pseudo) code is:


<search>
<query>|inputlookup stats.csv|stats dc(Sources) as Sources</query>
<earliest>0</earliest>
</search>
<option name="drilldown">all</option>
...
<option name="linkView">search</option>

My question is what should be the correct syntax of the child elements for <drilldown> to achieve the same result? Presumably I would use the <link> element but <link>search</link> is clearly not correct. Again, my apologies for being so dense.

Tags (2)
0 Karma

renjith_nair
Legend

@seanmcl,

You could use the search as option value of link

<drilldown>
    <link target="_blank">search?q=index=_internal | stats count by sourcetype</link>
</drilldown>

Please refer here for the syntax and usage : http://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/DrilldownLinkToSearch

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma

seanmcl
New Member

Sorry about the poor formattting. The Markdown documentation was not clear that you needed to mark down every line of code rather than just the block.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...