Splunk Search

Splunk Drilldown for a specific column in a table?

marmehta
New Member

I want to open a search with the case number user clicked the attached table sample. Currently, my search is getting the ANI information dynamically from the form, but I want the drill-down to get ANI as well as the clicked CASE_NUMBER.

Referringalt text to the below given example, in the panel named: Caller Actions by Unique Cases and DNISs" , I want that if I click on CASE_NUMBER 46770533, the search should take search parameters like "CASE_NUMBER=46770533" AND "ANI=1234567890" (The one entered in the form above).

Thanks in Advance.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@thambisetty  answer availalable at here would be useful 

————————————
If this helps, give a like below.
0 Karma

cmerriman
Super Champion

you need to create two tokens, one fore ANI and one for CASE_NUMBER

something like

<set token="case_num">$row.CASE_NUMBER$</set>
<set token="ani">$row.ANI$</set>

and then edit the search drilldown to use those two tokens.

something like

  <link target="_blank">search?q=<search in url encoded nonsense>&amp;CASE_NUMBER=$case_num$&amp;ANI=$ani$</link>
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...