Dashboards & Visualizations

Use of to replace linkView

seanmcl
New Member

I apologize for the fact that a similar question was already answered but the answer was not clear. I'm porting some older code to 6.6 and link View is deprecated. The old (pseudo) code is:


<search>
<query>|inputlookup stats.csv|stats dc(Sources) as Sources</query>
<earliest>0</earliest>
</search>
<option name="drilldown">all</option>
...
<option name="linkView">search</option>

My question is what should be the correct syntax of the child elements for <drilldown> to achieve the same result? Presumably I would use the <link> element but <link>search</link> is clearly not correct. Again, my apologies for being so dense.

Tags (2)
0 Karma

renjith_nair
Legend

@seanmcl,

You could use the search as option value of link

<drilldown>
    <link target="_blank">search?q=index=_internal | stats count by sourcetype</link>
</drilldown>

Please refer here for the syntax and usage : http://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/DrilldownLinkToSearch

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

seanmcl
New Member

Sorry about the poor formattting. The Markdown documentation was not clear that you needed to mark down every line of code rather than just the block.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...