How to pass a field value to a "Link to search" SPL query from a Dashboard table?

[tdavison76]

Hello,

I need help on passing a field value from a Dashboard table into a "Link to search" drilldown but can't figure it out.

I have a table that contains a "host" field.  I am needing to be able to click on any of the returned hosts and drill into all of the events for that host.  

I've tried in hopes that the $host$ would be replaced with the actual host name with this drilldown query:

source="udp:514" host="$host$.doman.com"

but, of course failed, it just get's replaced with "*".

I'm sure I'm probably way off on how to do this, but any help would be awesome. 🙂 

Thanks in advance.

Tom

[tdavison76]

Hey guys,

Thanks for the quick help, still stuck for some reason.  So I've tried $row.host$ and $result.host$ but they both result in just passing $xxx.host$ for some reason.  Here's the config:

Here's the resulting search:

Here's the table query:

index="netscaler" host=*
| rex field="servicegroupname" "\?(?<Name>[^\?]+)"
| rex field="servicegroupname" "(?<ServiceGroup>[^\?]+)"
| rename "state" AS LastStatus
| eval Component = host."|".servicegroupname
| search Name=*
| eval c_time=strftime(Time,"%m/%d/%Y %H:%M:%S")
| streamstats window=1 current=f global=f values(LastStatus) as Status by Component
| where LastStatus!=Status
| rename _time as "Date"
| eval Date=strftime(Date, "%m/%d/%Y %H:%M:%S")
| table Date, host, ServiceGroup, Name, Status, LastStatus

And, here's a screenshot of the table if helpful. 🙂 

Thanks again for the help on this one, very much appreciated.

Tom

[dural_yyz]

Ok so we know row and results works in other environments.  Something should be there based upon what we have seen from your SPL and table results.  I would recommend saving the updated drill down, then log out of splunk, close browser and clear cache/cookies, log into splunk, and reload dashboards.

[tdavison76]

Thanks,  I tried the steps, but same thing occurred.  I then quickly set up a Classic Dashboard instead of a Dashboard Studio, and it works.  Looks like either an issue with Studio, of maybe it's just done differently.  🙂

Thanks again,

Tom

[dural_yyz]

I had assumed you were doing Classic XML to start, Dashboard Studio is slightly different I can try testing later.

[tdavison76]

Sorry about that, I didn't think it would matter.  Looks like it does.  I've created a Support ticket for this as well.  Hopefully, they'll get back to me.  If they do, I'll let you know the solution with Studio. 🙂

Thanks again,

Tom

[richgalloway]

In Dashboard Studio it's $row.<<fieldname>>.value$.

$row.host.value$

[dural_yyz]

[richgalloway]

This is a better answer than mine.  $results$ will only pick up the first result rather than the row clicked.

[richgalloway]

Use $results.host$