I'm using Classic dashboard for this. I'm trying to use some of the results of a search beneath a Line Chart to modify a custom URL, but need to use values other than click.value, click.value2. For example: I'd like when a user clicks on a line which is grouped by cluster (A field generated with rex), I'd like to take them to a separate page, with that cluster pre-filled in. Everything I've read says "Just do $row.cluster$", or "$result.cluster". I thought maybe because it's a value generated with rex, that it might not work, but even things like $row.host$, which I've seen recommended in many places, but it always comes through as just "$row.host$", instead of the value of the field. I even made a token that references $row.host$, and it translates the token to `%3Frow.host%3F` instead of filling in the actual value. Here's a slightly trimmed down example of the line chart that is not giving me the proper custom values on drilldown (click.value/click.value2 both work, for what it's worth, but *only* those two): <search> <query>index="*" sourcetype="infra_memory" | regex host=".*?bar.*?" | rex <insert convoluted 'cluster' regex here> | rex field=host "[^0-9]*(?<stack_num>[0-9]+)-" | eval memory_usage = ((total-available)/total*100) | bucket _time span=1hour | chart p99(memory_usage) by _time, cluster</query> </search> <drilldown> <set token="TEST">$row.host$</set> <link target="_blank">/test:$TEST$-$row.TEST$,$tkn.TEST$/rowstuff:$row.stack_num$,$row.host$,$row.cluster$-clickstuff:$click.value$,$click.value2$,$click.host$-result:$result.sourcetype$,$result.host$</link> </drilldown> (As you can see, I've tried a bunch of different things, in a desperate attempt to find anything that works) Is what I'm trying to do possible?
... View more
