hello
I open a new drilldown window from my dashboard like this
<drilldown>
<link target="_blank">search?q=%60index_toto%60%20sourcetype%3D%22ez%3Acrash%22%20type%3D*%20%7C%20stats%20count%20as%20crash%20by%20host%20_time&earliest=-7d@h&latest=now</link></drilldown>
the exact search is
`index_toto` sourcetype="ez:crash" type=* | stats count as crash by host _time
I would like to add a token on the field host in order to display the results for this host in the new window results
could you help please?
Depending what you are trying to do in your search query, try something like this
<drilldown>
<link target="_blank">search?q=%60index_toto%60%20sourcetype%3D%22ez%3Acrash%22%20type%3D*%20host%3D%22$click.value$%22%20%7C%20stats%20count%20as%20crash%20by%20host%20_time&earliest=-7d@h&latest=now</link></drilldown>
Depending what you are trying to do in your search query, try something like this
<drilldown>
<link target="_blank">search?q=%60index_toto%60%20sourcetype%3D%22ez%3Acrash%22%20type%3D*%20host%3D%22$click.value$%22%20%7C%20stats%20count%20as%20crash%20by%20host%20_time&earliest=-7d@h&latest=now</link></drilldown>
ok perfect!