Splunk Enterprise

How to pass 2 different click.values when we use 'Link to search' drilldown method ?

georgear7
Communicator

I have below source code. My aim is to pass 2 click values(click.value & click.value2) to my search by using 'Link to search' drilldown method.
I have used 'time' dropdwon filter here. and below is my drilldown source code.

<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">search?q=index=index_foo%20source=*$click.value2$*restart.log&amp;earliest=$time.earliest$&amp;latest=$time.latest$</link>
</drilldown>

Output of my Main dashboard search:

Req                   JVM                     status
1732                 App1                 started
1732                 App2                 stopped
2747                 App1                 stopped


Actual source name is something like, 1732/App1_restart.log.
So if i click, App1 in the table after setting up drilldown, it will give me all the log files whichever having App1 in it. This will be a problem when i set time as last 30 days or 7 days.

So i want to pass my Req as well to my search to get the exact log. My Req number is unique here.

Note:
JVM names will be same for all the time, but Req no will differ.

Labels (1)
0 Karma

georgear7
Communicator

Hi @richgalloway , Need your input here.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...