I am trying to define a drilldown within a splunk form. However, when i click the row, it passes the variable $row.rid$ instead of the value.
Can someone where help what i am doing wrong?
Here is the code
<panel>
<table>
<title>Error Details</title>
<search>
<query>host="vmh001d009" index="coreservices" | transaction rid | search (level=ERROR OR level=FATAL) | rex field=url "http://(?<Service>[^/]+/[^/]+)" | eval Time=strftime(_time, "%H:%M %P %Z") | table Time, Service, funcname, user | rename funcname as Function, user as User</query>
<earliest>$timeSelection.earliest$</earliest>
<latest>$timeSelection.latest$</latest>
</search>
<drilldown>
<link>/app/coreservicesmonitoring/ptpe__debug?form.rid=$row.rid$</link>
</drilldown>
<option name="wrap">false</option>
<option name="rowNumbers">true</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<option name="drilldown">row</option>
</table>
</panel>
Here is what it resolves too; (note form.rid=%24row.rid%24 )
https://prodsplunk/en-US/app/coreservicesmonitoring/ptpe__debug?form.rid=%24row.rid%24&form.time.earliest=0&form.time.latest&earliest=0&latest=
... View more