Splunk Search

passing a variable/token through link search

smolcj
Builder

hi,
i have a simple xml form with a dropdown box and several single value panels. how can i pass the token from dropdown box through link search something like
index=main source=$sources$ sourcetype=plog |transaction startswith="Start"
i tried replacing $sources$ with form.source row.source.. but it is not working fine.
please help
Thank you

Tags (1)

Leo
Splunk Employee
Splunk Employee

Try this example and see if it helps with your situation.

smolcj
Builder

Sorry Leo, that is not what i want, here in your single value panel you have a field called count, is it? i want to drill down by clicking to that count field. how to embed the drill down in table to this single value output. i heard from nick that dirill down in single value panel cannot be dynamic, so i am thinking of closing this question
Thank you

0 Karma

Leo
Splunk Employee
Splunk Employee

It should work the same way. I've added a single value field to the previous example:
http://pastebin.com/BmW96WmQ

0 Karma

smolcj
Builder

how can i do it with single value panel? link search option in single value panel behaves like static

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Splunk Observability Metrics Cost Optimization

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...