Splunk Search

How do I set a token to an html search string

jeradb
Explorer
<row>
    <panel depends="$tok_tab_1$">
      <table>
        <title>Alerts Fired</title>
        <search>
          <query> index=_audit action=alert_fired 
| rename ss_name AS Alert 
| stats latest(_time) AS "Event_Time"  sparkline AS "Alerts Per Day" count AS "Times Fired"
first(sid) AS sid by Alert 
| eval Event_Time=strftime(Event_Time,"%m/%d/%y %I:%M:%S %P")
| rename Event_Time AS "Last Fired"
| sort -"Times Fired"
</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <fields>Alert, "Last Fired", "Times Fired", "Alerts Per Day"</fields>
        <option name="count">10</option>
        <option name="dataOverlayMode">heatmap</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="sid">$row.sid$</set>
          <unset token="tok_tab_1"></unset>
          <set token="tok_tab_2">active</set>
          <set token="tok_display_dd"></set>
          <set token="Alert">$row.Alert$</set>
           <link target="_blank">search?sid=$row.sid$</link>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$tok_tab_2$">
      <table>
        <title>$Alert$</title>
        <search>
          <query>| search?sid=$sid$</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>

 

 

In the code above the below line works correctly opening a new search tab with the Alert search query.

<link target="_blank">search?sid=$row.sid$</link>

I would like to know how to have this same functionality, but within a token so I can keep it on the same page within another table.

 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try 

<query>| loadjob $sid$</query>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try 

<query>| loadjob $sid$</query>
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...