Splunk ITSI

ITSI Drilldown into Splunk App for Infrastructure host from Episode

iatwal
Path Finder

So I have this Correlation search:
| mstats avg(LogicalDisk.%_Free_Space) as "logicaldisk_free_space" WHERE index="em_metrics" AND host=* AND instance!=_Total AND instance!=Hard* by host,instance
| eval host_dev=host . ":" . instance
| eval disk_used=100-logicaldisk_free_space
| eval disk_used = round(disk_used, 2)
| eval CRITICAL=6, MEDIUM=4
| eval ITSI_Severity=if(disk_used >= 80 AND disk_used <= 89, MEDIUM, if(disk_used >= 90, CRITICAL, "None"))
| fields - MEDIUM,CRITICAL
| rename host AS Host,
| table Host, "ITSI_Severity", disk_used, instance
| apply_entity_lookup(host)

I want to be able to drilldown into SAI through the Drilldown Website URL section within the Correlation Search. I understand the field for the entity is:
sai_entity_key

This is what I put as my URL: https://itsi.zzz.com/en-US/app/splunk_app_infrastructure/metrics_analysis?entity=%sai_entity_key%&ta...

Any thoughts as to what I'm doing wrong?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...