Custom Alert Action UI

[astatrial]

Hello!

I'm trying to append to the Alert ui the query itself (the search from which the user create the alert), in order to send it to another dashboard via link from the UI.

What i mean is that after a user will run a search, and will try to save it as an alert, the UI of the alert will contain a link to another dashboard with the search string.

I'm aware of the $search$ token but it doesn't seem to work.

Is this thing possible ?

[astatrial]

I think i explained myself wrong.
I'm trying to configure the alert UI so it will capture the query from which it was created (before the alert is actually saved). This means that it needs to be generic to every query.

I want to be able to append a link to the UI that will transfer the query to outside dashboard.

There is example in the next picture.

[harishalipaka]

@astatrial
try like this | return $linkfield

[astatrial]

where should i use it ?

[harishalipaka]

@astatrial

use in your query.can u share ur query

[astatrial]

Please refer to the answer i posted.
i couldn't attach a picture here so i created an answer.

Thanks !

[eduardkiyko_]

I guess, its impossible, you should re-write Splunks source code to append custom ui

[astatrial]

I'm able to create the custom alert UI, i'm just trying to somehow send to the UI window of the "saving as an alert" the search string.