Splunk Search

How do you customize the drilldown of a search?

heatonra
Engager

I've got a search viewed as a table and one of the values of the table cell is a URL. I want to be able to click on that URL and have the browser take me to it. My search results show that I need to customize the drilldown, but I don't see a drilldown customization in a search. Am I missing it somewhere? Is there any way to customize the drilldown of the "details" cell such that a click will take me to the URL that is the value of that cell?

Here's my (redacted) screenshot that shows what happens when I click on it (View events, Other events, etc.):

screenshot

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @heatonra

Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

gjanders
SplunkTrust
SplunkTrust

Refer to Use drilldown for dashboard interactivity if your running an older Splunk version such as 6.5.x there are other answers on SplunkAnswers or information in the documentation about editing the simpleXML for a drilldown.

In particular Link to a URL :

<link>[target_URL]?q=$[value_from_field_A]$</link>

You should be able to use your field value as part of your URL

0 Karma

kmaron
Motivator

Customizing the drill down is done with the edit options for a panel in a dashboard. (three dots - More Actions - Edit Drilldown).

Though I believe its meant just to open a specific search/dashboard/report within Splunk. I have no idea if it's possible to load a URL. Hopefully someone else can answer that part.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...