Selected Fields - Open in new tab (or window) - Value does not carry over.

[spunk311z]

There are several topics related to this , but it seems they not exactly what im asking (ie those are related to custom dashboards, while im asking with regard to the basic splunk search function).

When viewing search results, on the left sidebar ,  if you try to open a new tab via the results of either "selected fields" or "Interesting fields",  that value is not appended to the search (in the new tab).  But rather you just get a duplicate of the current search results.

Is there anyway to fix this?  (or to manually modify the splunk JS files to support this?)

animated gif screen cap of what im referring to (using v9.1.0.2 demo): (just adding screen shots, the web server  keeps throwing a Less than 1m characters error when i add the animated gif);

what im referring to:

what we get:

what im hoping for:

This has bugged me since splunk v6 (im now on v8 latest),  and just did a test / demo install of v9.1 and the issue remains with all versions.

thanks

some related topics that are very similar to what im asking here (but are not exactly the same):

https://community.splunk.com/t5/Dashboards-Visualizations/how-to-create-drilldowns-which-open-in-new...

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-enable-a-new-tab-opening-from-withi...

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-drill-down-launch-another-search-wi...

[inventsekar]

Hi @spunk311z ... this right click on the URL and opening it in a new tab is controlled by the Chrome browser.. (this may be a splunk issue.. I think, the right click'ed URL is not passing the extra fields i think).

One simple workaround is..  on the interesting fields list, instead of opening it in a new tab.. just click that interesting field directly.. so, the clicked interesting field will be added to the current SPL query and the logs will be filtered as per the interesting field you clicked. 

one issue.. this will just run in the current tab itself.. as you wanted it to open in a new tab... just do this. 

duplicate the current tab and click the interesting field. 

(On Chrome browser, to create duplicate tab, you can right click the tab and duplicate it.. ..

OR

You can use a combination of two keyboard shortcuts to duplicate a Chrome tab. Step 1 – Press ALT + D. This selects the current tab. Step 2 – While the URL is selected in the address bar, press ALT + ENTER.)

[richgalloway]

I've experienced the same thing and not just with Splunk.  Some web sites have the same behavior.  It seems like opening in a new tab opens the *current* page in that tab and does not apply the clicked field.  I suspect there is little we can do about this.