Splunk Enterprise

How to pass 2 different click.values when we use 'Link to search' drilldown method ?

georgear7
Communicator

I have below source code. My aim is to pass 2 click values(click.value & click.value2) to my search by using 'Link to search' drilldown method.
I have used 'time' dropdwon filter here. and below is my drilldown source code.

<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">search?q=index=index_foo%20source=*$click.value2$*restart.log&amp;earliest=$time.earliest$&amp;latest=$time.latest$</link>
</drilldown>

Output of my Main dashboard search:

Req                   JVM                     status
1732                 App1                 started
1732                 App2                 stopped
2747                 App1                 stopped


Actual source name is something like, 1732/App1_restart.log.
So if i click, App1 in the table after setting up drilldown, it will give me all the log files whichever having App1 in it. This will be a problem when i set time as last 30 days or 7 days.

So i want to pass my Req as well to my search to get the exact log. My Req number is unique here.

Note:
JVM names will be same for all the time, but Req no will differ.

Labels (1)
0 Karma

georgear7
Communicator

Hi @richgalloway , Need your input here.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...