How to show link to dashboard when view _raw in default search?

[exmuzzy]

I use default search screen to see _raw such as

2017-10-26 12:41:59,787 [20    ] 
----------------------------
requestID=Server&1509010919783-704536
messageID=Message@1509010919787-907822
actor=Agent->
ip=192.168.160.10
api=EncryptApi
method=DecryptFromUID
type=request
cardUID=7F006BE8
agent=breeze

How to decorate default search view to show "requestID=Server&1509010919783-704536" as hyperlink to dashboard
/payment?requestID=Server&1509010919783-704536
?

[niketn · Accepted solution]

@exmuzzy, are you looking for Creating Workflow Action in Splunk: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/SetupaGETworkflowaction

You can use Get Workflow to open a Splunk Dashboard with query string(tokens) from _raw events using field name or event type.

[exmuzzy]

It's work!

[niketn]

@exmuzzy, glad it worked, I have converted to answer please accept to mark the question as answered 🙂