Situation:
I have a panel. The panel creates a token for me from a field I extract from the search. In the same panel I create a URL that enables me to "drilldown".
My table appears to work nicely where each row represents unique open tickets. Problem: Question:
search...
| table "ticket_num", "Creation Date", "other_field", "other_field"
5
none
row
true
<eval>replace($row.url$, "http://", ""</eval>
<link target="_blank">
<![CDATA[ https://other.tool/$ticket_num$ ]]>
</link>
</drilldown>
</table>
</panel>
You'll likely need some form of this:
<drilldown>
<link target="_blank">/app/some_app/some_dashboard?token=$click.value$&token2=$row.fieldname$</link>
</drilldown>
https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/tokens
You'll likely need some form of this:
<drilldown>
<link target="_blank">/app/some_app/some_dashboard?token=$click.value$&token2=$row.fieldname$</link>
</drilldown>
https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/tokens
@memarshall63 - thanks so much for your time to write this comment. This led me down the right path! The below appears to create a unique URL per row that is clicked. Thanks so much.
<link target="_blank">
<![CDATA[ https://other.tool/$click.value$ ]]>
</link>
No problem. I believe $click.value$ will give you the field that is clicked. However, you may want to use a specific field regardless of where on the row the click occurs. When that occurs I think $row.$ is the choice for that behavior. At any rate... good luck.