Hello!
I'm trying to append to the Alert ui the query itself (the search from which the user create the alert), in order to send it to another dashboard via link from the UI.
What i mean is that after a user will run a search, and will try to save it as an alert, the UI of the alert will contain a link to another dashboard with the search string.
I'm aware of the $search$ token but it doesn't seem to work.
Is this thing possible ?
I think i explained myself wrong.
I'm trying to configure the alert UI so it will capture the query from which it was created (before the alert is actually saved). This means that it needs to be generic to every query.
I want to be able to append a link to the UI that will transfer the query to outside dashboard.
There is example in the next picture.
@astatrial
try like this | return $linkfield
where should i use it ?
@astatrial
use in your query.can u share ur query
Please refer to the answer i posted.
i couldn't attach a picture here so i created an answer.
Thanks !
I guess, its impossible, you should re-write Splunk
s source code to append custom ui
I'm able to create the custom alert UI, i'm just trying to somehow send to the UI window of the "saving as an alert" the search string.