How do I drilldown to a unique URL using a table row's unique token?

[jsven7]

Situation:

• I have a panel. The panel creates a token for me from a field I extract from the search. In the same panel I create a URL that enables me to "drilldown".

  
  
  
  

  
  
  
  search...
  | table "ticket_num", "Creation Date", "other_field", "other_field"
  
  $field3.earliest$
  $field3.latest$
  
  
  $result.ticket_num$
  
  
  5
  none
  row
  true
  

         <eval>replace($row.url$, "http://", ""</eval>
         <link target="_blank">
           <![CDATA[ https://other.tool/$ticket_num$ ]]>
         </link>
       </drilldown>
  
    </table>
  </panel>
  

  My table appears to work nicely where each row represents unique open tickets.

  Problem:

  • All rows, upon clicking, "drilldown" only to the first row's "ticket_num". Which I think makes sense.

  Question:

  • Can you pleas share if its possible with ES simple XML and without any other add-on to modify the panel so that, upon clicking a row, I "drilldown" to the respective row's unique "ticket_num"?

[memarshall63 · Accepted solution]

You'll likely need some form of this:

<drilldown>
  <link target="_blank">/app/some_app/some_dashboard?token=$click.value$&amp;token2=$row.fieldname$</link>
</drilldown>

https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/tokens

[jsven7]

@memarshall63 - thanks so much for your time to write this comment. This led me down the right path! The below appears to create a unique URL per row that is clicked. Thanks so much.

            <link target="_blank">
              <![CDATA[ https://other.tool/$click.value$ ]]>
            </link>

[memarshall63]

No problem. I believe $click.value$ will give you the field that is clicked. However, you may want to use a specific field regardless of where on the row the click occurs. When that occurs I think $row.$ is the choice for that behavior. At any rate... good luck.