Splunk Enterprise

How to pass 2 different click.values when we use 'Link to search' drilldown method ?


I have below source code. My aim is to pass 2 click values(click.value & click.value2) to my search by using 'Link to search' drilldown method.
I have used 'time' dropdwon filter here. and below is my drilldown source code.

<option name="drilldown">cell</option>
<link target="_blank">search?q=index=index_foo%20source=*$click.value2$*restart.log&amp;earliest=$time.earliest$&amp;latest=$time.latest$</link>

Output of my Main dashboard search:

Req                   JVM                     status
1732                 App1                 started
1732                 App2                 stopped
2747                 App1                 stopped

Actual source name is something like, 1732/App1_restart.log.
So if i click, App1 in the table after setting up drilldown, it will give me all the log files whichever having App1 in it. This will be a problem when i set time as last 30 days or 7 days.

So i want to pass my Req as well to my search to get the exact log. My Req number is unique here.

JVM names will be same for all the time, but Req no will differ.

Labels (1)
0 Karma


Hi @richgalloway , Need your input here.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...