Triggering a Google search from the chart drilldown options

Workflow actions work well when you are in an event-based view, but sometimes you might wish to perform a Google search when looking at data within a visualization. By adding the following simple modifications to the SimpleXML in a chart element, you can have the chart linked to Google as well:

<drilldown> 
<link target="_blank"> http://google.com/search?q=$row.sourcetype$ 
</link> 
</drilldown> 

You can replace $row.sourcetype$ with the correct chart variable you need to pass to your Google search.

Get Splunk Operational Intelligence Cookbook - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.