Search code examples
splunksplunk-dashboard

Splunk - Open query in search

I have a Splunk dashboard written with Simple XML. A basic version of this dashboard is like this:

<form version="1.1">
  <label>Overview</label>
  <fieldset submitButton="true" autoRun="true">    
    <input type="text" token="myId" searchWhenChanged="true">
      <label>Id</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>

  <search id="my_events">
    <query>
      index=my_events "Middleware" "$myId$"
      | fields *
    </query>
  </search>

  <panel>
    <html>
      <div>
        <a href="#">view query in search</a>
      </div>
    </html>
  </panel>
</form>

When a user clicks the "view query in search" link, I would like to open the my_events search query in the Splunk Search utility in a new tab. Is there a way to do this? I suspect there is as when you add a table, a "Open in Search" button is available. However, I have not found any documentation that shows how to do this.

Solution

  • Splunk has a open in search for all the panels you can use.

    also you can also used saved searches for a similar affect eg in Search:

    | savedsearch {searchname} myId="*"

    https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch