So I have this Correlation search:
| mstats avg(LogicalDisk.%_Free_Space) as "logicaldisk_free_space" WHERE index="em_metrics" AND host=* AND instance!=_Total AND instance!=Hard* by host,instance
| eval host_dev=host . ":" . instance
| eval disk_used=100-logicaldisk_free_space
| eval disk_used = round(disk_used, 2)
| eval CRITICAL=6, MEDIUM=4
| eval ITSI_Severity=if(disk_used >= 80 AND disk_used <= 89, MEDIUM, if(disk_used >= 90, CRITICAL, "None"))
| fields - MEDIUM,CRITICAL
| rename host AS Host,
| table Host, "ITSI_Severity", disk_used, instance
| apply_entity_lookup(host)
I want to be able to drilldown into SAI through the Drilldown Website URL section within the Correlation Search. I understand the field for the entity is:
sai_entity_key
This is what I put as my URL: https://itsi.zzz.com/en-US/app/splunk_app_infrastructure/metrics_analysis?entity=%sai_entity_key%&ta...
Any thoughts as to what I'm doing wrong?
