Splunk Search
Highlighted

Send Drilldown Search to a New Window

Motivator

I want to click on an entry in a table and see the record or records behind it in a new window.
I found one question which may be similar to this (http://answers.splunk.com/answers/28208/how-to-drill-down-launch-another-search-with-parameter-from-...), but the OP brought in XML code and the answer didn't lend itself at all to what I am after.

It may be nice to have the drilldown simply launch new searches in new tabs/windows, but when I look at a row, I am mostly interested in seeing the rest of the details behind the event or events which created it without losing the search already on the screen. In many cases, having the current results up for comparison against the details of the event(s) is preferred.

Highlighted

Re: Send Drilldown Search to a New Window

SplunkTrust
SplunkTrust

Are you using SimpleXML?

If so, take a look at this: http://docs.splunk.com/Documentation/Splunk/6.0.2/Viz/PanelreferenceforSimplifiedXML#Drilldown_eleme...
You can specify a target attribute for the drilldown element to control where the click leads to.

Highlighted

Re: Send Drilldown Search to a New Window

Motivator

How do I know if I am using SimpleXML? The only time I notice XML is when I am editing a dashboard using the XML option. Your reference mentioned adding a "_blank" to the link, but where are the SimpleXML code and the link option within it?

0 Karma
Highlighted

Re: Send Drilldown Search to a New Window

SplunkTrust
SplunkTrust

You're using SimpleXML if you have the graphical drag-and-drop dashboard editor available.

0 Karma
Highlighted

Re: Send Drilldown Search to a New Window

Motivator

So when I click "edit Panel", that is SimpleXML? Where would the "_blank" go using that gui interface? I am familiar with the drilldown gui controls under the "edit Panels" option, Panel-General menu.

Sidenote: Also, I learned the hard way that text from search results cannot be highlighted while in Panel edit mode.

0 Karma
Highlighted

Re: Send Drilldown Search to a New Window

SplunkTrust
SplunkTrust

Yeah, that's SimpleXML. Not sure if the target attribute is available in the UI, you can always choose Edit Source and add the attribute there.

0 Karma
Highlighted

Re: Send Drilldown Search to a New Window

Motivator

Based on your feedback and the link that you provided above, I believe that the code to send drilldown to a new window would be added between the table code tags as:

~~<drilldown>
  <link>
      _blank
  </link>
</drilldown>~~

Does that look right?

Field passing to Splunk, other webpages, etc. seems to require XML customization of each Panel in a dashboard.

Is there a way to pass the data in a row straight to the clipboard when clicked?

~~<drilldown>
  <link field="A">
      clipboard=$dest_value$
  </link>
</drilldown>~~

Am I on the right trail?

0 Karma
Highlighted

Re: Send Drilldown Search to a New Window

SplunkTrust
SplunkTrust

You're looking for something like this:

<drilldown target="_blank">
  <link>your_page?field=$field_name$</link>
</drilldown>

As for copying stuff to the clipboard, JavaScript cannot access the clipboard in any modern browser for security reasons.

Highlighted

Re: Send Drilldown Search to a New Window

Motivator

Will that code work verbatim to launch a Splunk drilldown search in a new window or do I have to put something specific into the "your_page" part of your code?

Is there a way to throw the field or row values into notepad, instead of the clipboard?

Added:
Any way to launch drilldown searches from the standard search bar into new window, too (not dashboard).

0 Karma
Highlighted

Re: Send Drilldown Search to a New Window

SplunkTrust
SplunkTrust

You will have to replace the content of the link tag with your drilldown destination and passed fields.

I don't think JavaScript is allowed to somehow communicate with external programs such as notepad, that would seriously violate the browser sandbox.

0 Karma