Splunk Search

How do I set a token to an html search string

jeradb
Explorer
<row>
    <panel depends="$tok_tab_1$">
      <table>
        <title>Alerts Fired</title>
        <search>
          <query> index=_audit action=alert_fired 
| rename ss_name AS Alert 
| stats latest(_time) AS "Event_Time"  sparkline AS "Alerts Per Day" count AS "Times Fired"
first(sid) AS sid by Alert 
| eval Event_Time=strftime(Event_Time,"%m/%d/%y %I:%M:%S %P")
| rename Event_Time AS "Last Fired"
| sort -"Times Fired"
</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <fields>Alert, "Last Fired", "Times Fired", "Alerts Per Day"</fields>
        <option name="count">10</option>
        <option name="dataOverlayMode">heatmap</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="sid">$row.sid$</set>
          <unset token="tok_tab_1"></unset>
          <set token="tok_tab_2">active</set>
          <set token="tok_display_dd"></set>
          <set token="Alert">$row.Alert$</set>
           <link target="_blank">search?sid=$row.sid$</link>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$tok_tab_2$">
      <table>
        <title>$Alert$</title>
        <search>
          <query>| search?sid=$sid$</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>

 

 

In the code above the below line works correctly opening a new search tab with the Alert search query.

<link target="_blank">search?sid=$row.sid$</link>

I would like to know how to have this same functionality, but within a token so I can keep it on the same page within another table.

 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try 

<query>| loadjob $sid$</query>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try 

<query>| loadjob $sid$</query>
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...