Splunk Search

Drilldown to link to search

navd
New Member

My sample code looks like this how do I apply/insert drilldown to my code , to link to search results

 <form>
 <label> Areas</label>
  <row>
<panel>
  <title></title>
  <html>
    <p>
     <h2>
        <strong> abc </strong>
      </h2> 
    </p>
    </html>
  </panel>
  </row>
</form> 
Tags (1)
0 Karma

TISKAR
Builder

Hello,

If you have a search query in your dashboard you can use else you can use the html balise

For example (You can pas all this code in your dashboard):

<form>
  <label>TEST</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="field1">
      <label>field1</label>
      <choice value="Host">Host</choice>
      <choice value="Environment">Environment</choice>
      <choice value="Node Group">Node Group</choice>
      <delimiter>:</delimiter>
      <valuePrefix>'</valuePrefix>
      <valueSuffix>'</valueSuffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count by log_level | eventstats sum(count) as somme | eval perc=100*count/somme</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>

        <drilldown>
         <link>
           <![CDATA[ http://localhost:8000/fr-FR/app/search/search?q=search%20index%3D_internal%20log_level%3D*&]]>
         </link>
        </drilldown>


        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
        <html>
          <a href="http://localhost:8000/fr-FR/app/search/search?q=search%20index%3D_internal%20log_level%3D*">drilldown</a>
        </html>
        </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...