Hello All,
I have a usecase to generate a drill down from a dashboard to the "Show Source" view. I am able to open a new tab that is the show source view but it is not populated. I think I need to try and pass the sid to the show source view. I tried to do this by setting a token to equal the job.sid. However, this token has a bunch of other data such as username etc and doesn't work. Does anyone have experience linking to show source and if so how did you do it?
Thanks!
Hi @rwardwell ,
Have you had any luck in achieving this ? If yes, then can you please share your inputs as I am struggling with the same.
@rwardwell @ak9092 how about something like this? You have to ensure that Dashboard search for drilldown has raw events only using purely streaming command.
<dashboard>
<label>Table with Show Source Drilldown</label>
<search>
<query>| makeresults
| eval app="$env:app$"</query>
<done>
<set token="app">$result.app$</set>
</done>
</search>
<row>
<panel>
<table>
<search>
<done>
<set token="sid">$job.sid$</set>
</done>
<query>index=_internal sourcetype=splunkd log_level!=INFO
| fields _time log_level _raw
| head 50</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<link target="_blank">http://localhost:8000/en-US/app/$app$/show_source?sid=$sid|n$</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>