Thank you very much for your time and your help. I'm sending my data directly to splunk cloud using an http event collector. My data is in json, here's a short example (i deleted everything in the json irrelevant to my issue). { "host": "WM_DEV", "sourcetype": "oscar_menu:json", "event": { "header": { "context": { "correlationId": "194d1b90-8ff3-41cf-88d2-d6b17577de32" }, "data": { "site": { "idSite": "123" } } } } I'm using an index called "cgf_oscar_dev" and my sourcetype is called "menu_oscar:json" Here's my sourcetype My data is correctly uploaded to splunk, and my search does show my data in a table on my dashboard. index=oscar_dev sourcetype=oscar_menu:json | rename header.context.correlationId as correlationId | table correlationId I have another dashboard called oscar_menus, both of these dashboards are in the same app cgf_oscar. Below is the code of my table viz { "type": "splunk.table", "dataSources": { "primary": "ds_i2tU0SbB" }, "options": { "showRowNumbers": true, "backgroundColor": "> themes.defaultBackgroundColor", "tableFormat": { "rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByTheme)" } }, "eventHandlers": [ { "type": "drilldown.linkToDashboard", "options": { "app": "cgf_oscar", "dashboard": "oscar_menus", "tokens": [ { "token": "tok_correlationId", "value": "row.correlationId.value" } ], "newTab": true } } ], "context": {}, "showProgressBar": false, "showLastUpdated": false } Right now, the drilldown.linkToDashboard isn't working, my click are ignored. If i set it to a drilldown.customUrl then my click does redirect me to my custom url but the token $row.correlationId.value|u$ isn't passed properly and i have the text of the token instead of its value. When i try to add a drilldown on my table i only have the urlCustom option... The error appears when i click on the column name "correlationId" on the top of my table.
... View more