Splunk Enterprise

How to pass 2 different click.values when we use 'Link to search' drilldown method ?

georgear7
Communicator

I have below source code. My aim is to pass 2 click values(click.value & click.value2) to my search by using 'Link to search' drilldown method.
I have used 'time' dropdwon filter here. and below is my drilldown source code.

<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">search?q=index=index_foo%20source=*$click.value2$*restart.log&amp;earliest=$time.earliest$&amp;latest=$time.latest$</link>
</drilldown>

Output of my Main dashboard search:

Req                   JVM                     status
1732                 App1                 started
1732                 App2                 stopped
2747                 App1                 stopped


Actual source name is something like, 1732/App1_restart.log.
So if i click, App1 in the table after setting up drilldown, it will give me all the log files whichever having App1 in it. This will be a problem when i set time as last 30 days or 7 days.

So i want to pass my Req as well to my search to get the exact log. My Req number is unique here.

Note:
JVM names will be same for all the time, but Req no will differ.

Labels (1)
0 Karma

georgear7
Communicator

Hi @richgalloway , Need your input here.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...