- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: How to show link to dashboard when view _raw i...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I use default search screen to see _raw such as
2017-10-26 12:41:59,787 [20 ]
----------------------------
requestID=Server&1509010919783-704536
messageID=Message@1509010919787-907822
actor=Agent->
ip=192.168.160.10
api=EncryptApi
method=DecryptFromUID
type=request
cardUID=7F006BE8
agent=breeze
How to decorate default search view to show "requestID=Server&1509010919783-704536" as hyperlink to dashboard
/payment?requestID=Server&1509010919783-704536
?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@exmuzzy, are you looking for Creating Workflow Action in Splunk: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/SetupaGETworkflowaction
You can use Get Workflow to open a Splunk Dashboard with query string(tokens) from _raw events using field name or event type.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@exmuzzy, are you looking for Creating Workflow Action in Splunk: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/SetupaGETworkflowaction
You can use Get Workflow to open a Splunk Dashboard with query string(tokens) from _raw events using field name or event type.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's work!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@exmuzzy, glad it worked, I have converted to answer please accept to mark the question as answered 🙂
| makeresults | eval message= "Happy Splunking!!!"
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
