Splunk Search

Is there a way to query without using index, source or sourcetype?

Jitendra33
Engager

Hi All,

 

I want to create Multiple tables/Panels inside a dashboard which will have static message like DASHBAORD A, DASHBAORD B, DASHBAORD C etc.. These message's will drill down to respective dashboards A,B and C. 

Currently i am using a query :

index=*  
| head 1
| eval DashboardName="Dashboard A"
|table DashboardName



Is there a way to put a query with static message without to go and search a a set of events using index,source or sourcetype. I don't want to unnecessary use this.

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use target="_blank" to open in the new tab

<a href="dashboard_name" target="_blank">blablabla</a>

 https://www.w3schools.com/tags/att_a_target.asp

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Use 

| makeresults
| eval Dashboard="Dashboard A"
| table Dashboard

or you can add an html panel with <a> tags in there

<panel>
  <html>
    <a href="....">Dashboard A</a>
  </html>
</pamel>

Jitendra33
Engager

That really helped @bowesmana . Also while using href, how to use that to open the link in a new tab?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use target="_blank" to open in the new tab

<a href="dashboard_name" target="_blank">blablabla</a>

 https://www.w3schools.com/tags/att_a_target.asp

 

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...