When implementing the link to a search in a dashboard drilldown, can you help me configure the "auto" feature?

[damucka]

Hello,

I would like to implement the drilldown in my panel with the "Link to a Search". The "Auto" option seems to be a good choice as it generates the proper search with filters. There is, however, one thing I am not able to overcome there — I do not see any possibility to open the drilldown in the new tab window. It seems to be possible only in the "Custom" drilldown mode. This is quite an issue for me because when the drilldown opens in the same web tab, then by coming back to the main dashboard all the panels get refreshed, which I do not want.

Is there any possibility to get the "Auto" drilldown with the link to search opening in the new web tab?

I workaround it at the moment using the "Custom" mode, but then I have to work with tokens to get a proper search — I would rather let the "Auto" mode do the job instead.

Kind Regards,
Kamil]

[martin_mueller · Accepted solution]

I don't think that's possible at the moment without coding a JS extension because the place SimpleXML dashboard panels store the "open in new tab" config is an attribute of the link element inside the drilldown element - that link element is used for specifying a custom link to a dashboard, search, or 3rd party URL.
https://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/PanelreferenceforSimplifiedXML#link

[martin_mueller]

Check out these docs: http://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/PanelreferenceforSimplifiedXML#chart_2

$earliest$ $latest$ will be the time range clicked, pass that into your search to zoom into that minute.
$click.value2$ should be the host value clicked, pass that into your search to filter for that host.

From memory it should be something like this: <link target="_blank">search?earliest=$earliest$&amp;latest=$latest$&amp;q=index=mlbso sourcetype=$SYSID$_abaptraces ABAPERROR=* host=$click.value2|s$</link>

[damucka]

Thank you.
Instead of $click.value2$ I had to use the $click.name2$ and it works fine.
BR, Kamil

[damucka]

Hello,

Thank you.
It looked to me so when checking the SimpleXML, but I wanted to confirm it.

In that case perhaps you can help me with the following:
- I have a panel with the search where I want to list the errors per host in the last 24 hours:

index=mlbso sourcetype=$SYSID$_abaptraces ABAPERROR=*
 | timechart count by host span=1m

Now I want to create the Custom Drilldown with the Link to Search that is working the same way the "Auto" does, meaning when I click on the chart point it will bring me to the events of that particular host and particular time span of 1 minute.
How would I achieve that? What tokens would I have to set and how the custom search would have to look like?

Kind Regards,
Kamil