I want to click on an entry in a table and see the record or records behind it in a new window.
I found one question which may be similar to this (http://answers.splunk.com/answers/28208/how-to-drill-down-launch-another-search-with-parameter-from-...), but the OP brought in XML code and the answer didn't lend itself at all to what I am after.
It may be nice to have the drilldown simply launch new searches in new tabs/windows, but when I look at a row, I am mostly interested in seeing the rest of the details behind the event or events which created it without losing the search already on the screen. In many cases, having the current results up for comparison against the details of the event(s) is preferred.
Are you using SimpleXML?
If so, take a look at this: http://docs.splunk.com/Documentation/Splunk/6.0.2/Viz/PanelreferenceforSimplifiedXML#Drilldown_eleme...
You can specify a
target attribute for the
drilldown element to control where the click leads to.
How do I know if I am using SimpleXML? The only time I notice XML is when I am editing a dashboard using the XML option. Your reference mentioned adding a "_blank" to the link, but where are the SimpleXML code and the link option within it?
So when I click "edit Panel", that is SimpleXML? Where would the "_blank" go using that gui interface? I am familiar with the drilldown gui controls under the "edit Panels" option, Panel-General menu.
Sidenote: Also, I learned the hard way that text from search results cannot be highlighted while in Panel edit mode.
Yeah, that's SimpleXML. Not sure if the
target attribute is available in the UI, you can always choose Edit Source and add the attribute there.
Based on your feedback and the link that you provided above, I believe that the code to send drilldown to a new window would be added between the table code tags as:
~~<drilldown> <link> _blank </link> </drilldown>~~
Does that look right?
Field passing to Splunk, other webpages, etc. seems to require XML customization of each Panel in a dashboard.
Is there a way to pass the data in a row straight to the clipboard when clicked?
~~<drilldown> <link field="A"> clipboard=$dest_value$ </link> </drilldown>~~
Am I on the right trail?
You're looking for something like this:
<drilldown target="_blank"> <link>your_page?field=$field_name$</link> </drilldown>
Will that code work verbatim to launch a Splunk drilldown search in a new window or do I have to put something specific into the "your_page" part of your code?
Is there a way to throw the field or row values into notepad, instead of the clipboard?
Any way to launch drilldown searches from the standard search bar into new window, too (not dashboard).
You will have to replace the content of the
link tag with your drilldown destination and passed fields.