Assuming I defined a correlation search in Splunk Enterprise Security as the following:
index="_internal" sourcetype="splunkd" log_level="INFO" | stats count by name message | rename name AS "alert name"
How can I pass the token "alert name" to the drilldown search?
I have been looking over some previous questions like this and I am running into the same issues you have encountered. I am trying to understand where you are trying to get at the end of the day though.
I realize your example search is very generic, but why are you looking to rename that value to a multi word value? Is that associated with how you want it to be shown on the Incident Response page? If so, could that be solved in a different manner in the ES Config - Incident Review Settings - Incident Review Field Attributes?
That way the drill down could stay as search index=Internal $name$ as you have in the example, but the display would show Alert Name when you expand the notable event.
That may not be where you are going with this but figured I would throw that out.
Hope this helps...
Assuming you want to drilldown when you click on any rows of your search results, you can try as suggested in below sample/runanywhere dashboard.
<form> <label>ForTest_Delete</label> <row> <panel> <table> <title>Fired Alerts - token=$alertname$</title> <search> <query>index=_internal sourcetype=scheduler status=success alert_actions=summary_index | stats count by savedsearch_name | rename savedsearch_name as "Alert Name"</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="drilldown">row</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> <drilldown> <set token="alertname">$row.Alert Name$</set> </drilldown> </table> </panel> </row> </form>
Hi somesoni2, thank you for your information. However, this is related to the correlation search from Splunk Enterprise Security (app), and it is not related to dashboard creation. Please see "Drill-down search" (field) from the image below: