Splunk Search

Is there a way to query without using index, source or sourcetype?

Jitendra33
Engager

Hi All,

 

I want to create Multiple tables/Panels inside a dashboard which will have static message like DASHBAORD A, DASHBAORD B, DASHBAORD C etc.. These message's will drill down to respective dashboards A,B and C. 

Currently i am using a query :

index=*  
| head 1
| eval DashboardName="Dashboard A"
|table DashboardName



Is there a way to put a query with static message without to go and search a a set of events using index,source or sourcetype. I don't want to unnecessary use this.

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use target="_blank" to open in the new tab

<a href="dashboard_name" target="_blank">blablabla</a>

 https://www.w3schools.com/tags/att_a_target.asp

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Use 

| makeresults
| eval Dashboard="Dashboard A"
| table Dashboard

or you can add an html panel with <a> tags in there

<panel>
  <html>
    <a href="....">Dashboard A</a>
  </html>
</pamel>

Jitendra33
Engager

That really helped @bowesmana . Also while using href, how to use that to open the link in a new tab?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use target="_blank" to open in the new tab

<a href="dashboard_name" target="_blank">blablabla</a>

 https://www.w3schools.com/tags/att_a_target.asp

 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...