I got the following output by using the below code...
index values(sources)
main c://taskmanager/taskmanager_log
list continues....
<?xml version='1.0' encoding='utf-8'?>
My requirement is if click the specific source i want see the query in the search ber as
index="main" source="c://taskmanager/taskmanager_log"|transaction TaskAction startswith=START endswith=Succeeded|
plz verify the code..and give suggestion
try this:
...
/app/search/flashtimeline?q=index=$row.index$ source=$row.source$|transaction TaskBP startswith=START endswith=Succeeded|table TaskBP Duration
...
Also, note that this will only work on Splunk 5.0
If you're on an older version, you should use advanced xml drilldown.