Prerequisite

You must be an administrator to create global data links.

For information about granting administrative access, see Create and manage users in Splunk Observability Cloud.

Create a global data link

This procedure describes how to create a global data link for any available metadata using the Global Data Link page.

For information about how to create a global data link using the Splunk Observability Cloud API, see the Link Metadata to Related Content topic in the Splunk Observability Cloud Developer Guide.

For information about how to create a global data link for Splunk APM properties, see Link APM services, traces, and spans to relevant resources.

1. In the Splunk Observability Cloud main menu, select Settings then Global Data Links.

2. Select New Link.

3. In the Link Label field, enter the text you want to display as the global data link text.

4. In the Link to field, select your link target type. Select from the following targets for your global data link:

   • Custom URL: Links to a custom URL.

   • Splunk: Links to Splunk Cloud Platform or Splunk Enterprise.

   • Splunk Observability Cloud Navigator: Links to a navigator in Splunk Observability Cloud. Select Choose Navigator to select the navigator you want to link to.

   • Splunk Observability Cloud Dashboard: Links to a dashboard in Splunk Observability Cloud. Select Choose Dashboard to select the dashboard you want to link to.

   • Kibana: Links to a Kibana log.

   • AppDynamics tier: Links to a Splunk AppDynamics tier.

5. In the Show On list, select a value that indicates where you want the global data link to display:

   • Any Metadata Value: Display the link for any metadata value. This option isn’t available if you set the Link to field to Splunk Observability Cloud Dashboard.

   • Any Value of: Display the link for any value of a specific piece of metadata.

     For example, select Any Value of and enter aggregration_type to display the link for any aggregration_type value.

   • Property:Value Pair: Display the link for a specific value of a specific piece of metadata.

     For example, select Property:Value Pair and enter aggregration_type:average to display the link only for an aggregation_type value of average.

   • Inferred service: Display the link for an inferred service. For more information on inferred services, see Analyze the performance of inferred services.

6. If you want the link to display based on the Show On value and one or more additional conditions, select Add Conditions. If you define multiple conditions, the link only displays if all the conditions are true.

   For details about how to use the Any Value of and Property:Value Pair options, see the previous step.

7. If you set the Link to field to Custom URL, Splunk, Kibana, or AppDynamics tier, the URL field displays. Enter the URL you want the global data link to lead to.

   For more information about the instructions and URL requirements for linking to a Splunk AppDynamics tier, see Link APM properties to Splunk AppDynamics tiers.

   Optionally, for Custom URL and Kibana link target types, you can use any of the following placeholder variables in your URL. When you select the global data link, the system replaces the variables with actual values to create the destination URL.

   • {{key}}: Use this variable to populate the key name from the context where the link displays. For example, if you set Show on to aggregation_type, aggregation_type replaces {{key}} in the URL.

   • {{value}}: Use this variable to populate the key value from the context where the link displays. For example, if you set Show on to aggregation_type and the aggregation_type value in context is average, average replaces {{value}} in the URL.

   • {{start_time}}: Use this variable to populate the start time of the time window from the context where the link displays. The system inserts the timestamp using the format you select in the Time Format field.

   • {{end_time}}: Use this variable to populate the end time of the time window from the context where the link displays. The system inserts the timestamp using the format you select in the Time Format field.

   • {{properties.<property_name>}}: Use this variable to populate other metadata from the context of the link display. For example, properties contains a map of the metadata key names and values that appear in the context of the global data link display. To insert a name and value from this map, use {{properties.<your_property_name>}}. If your property name has a period in it, use square brackets around the value. For example, {{properties.[<property.name>]}}.

8. If you select a Link to value of Custom URL or Kibana, the Time Format field appears. Set this field to select the timestamp format used for the global data link’s starting and ending timestamps. Setting this field also helps ensure compatibility with the external system you are linking to. Select one of the following time formats:

   • ISO 8601: YYYY-MM-DDThh:mm:ss.SSSZ

   • Unix Time: epoch milliseconds

   • Unix Time: epoch seconds

9. If you select a Link to value of Custom URL, Splunk, or Kibana, the Minimum Time Window field appears. The time window is the interval during which the system captured the chart, dashboard, service map, or trace data. If this interval is shorter than the minimum time window value you select here, the global data link adjusts the start time to an earlier time so the interval is as long as the minimum time window.

10. If you select a Link to value of Custom URL, Splunk, or Kibana, the Property mapping options appear. Use property mapping if your URL value contains Splunk Observability Cloud key names and values that are referred to differently in the external system you’re linking to.

    For example, you can use property mapping to map a Splunk Observability Cloud key name, such as host, to an external system key name, such as hostname. You can also use property mapping to map an Observability key name, such as host, and key value, such as west-internal-123456, to an external system key name, such as hostname, and key value, such as 123456-west-int.

    To use property mapping, select Choose a Property to select a Splunk Observability Cloud key name or key name and value pair. Then, enter the external key name or key name and value pair that you want to map to in the External Term field.

11. Select Save.

Alternatively, here are some other locations in Splunk Observability Cloud where you can access the ability to create global data links:

• When you view an alert message that includes data links, select the More menu (⋯) next to a data link and select Configure data links.

• When you are on a dashboard, select Data Links from the Dashboard actions menu. If there are existing global data links defined for your organization, you can see a message to that effect on the Data Links tab. Select Global Data Links.

• When you view a list in a Splunk Infrastructure Monitoring navigator, select the Actions menu for any property and select Configure data links.

• When you view an inferred service on the APM Service Map, select the (⋯) menu next to the inferred service name. Then select Configure data links.

• To create a global data link when you create a data link from a dashboard, select a scope of Entire Organization.

Example custom URL global data link configuration

To illustrate the field values you enter on the Global Data Links page, here’s an example configuration for a global data link to a custom URL:

This global data link displays for the aggregation_type metadata on a dashboard, as shown here:

When you select the global data link, the URL you defined on the Global Data Links page immediately appears. For example, consider the URL defined in following example:

https://www.example.com/search/?field={{key}}&value={{value}}&service={{properties.unit}}&st={{start_time}}&et={{end_time}}

When you select the global data link for an aggregation_type metadata value of total, the URL appears in the following form:

https://www.example.com/search/?field=aggreg-type&value=ttl&service=Bytes&st=2021-09-02T01:13:30.000Z&et=2021-09-02T01:18:30.000Z

For more global data link configuration examples, see the following topics. While these topics are specific to Splunk APM properties, you can apply the guidance to any property:

• Link APM properties to Splunk platform logs

• Link APM properties to Kibana logs

Access global data links

After you’ve created a global data link, it displays for your specified metadata in any of the following relevant areas of Splunk Observability Cloud. While you must be an administrator to create a global data link, anyone can access the global data links you create.

Data tables

For information about data tables, see View the Data Table tab.

List charts

For information about list charts, see List charts.

Alert messages

For information about alerts, see View alerts in Splunk Observability Cloud.

Service names and trace IDs in Splunk Application Performance Monitoring (APM)

For more information about accessing global data links in Splunk APM, see Access relevant resources linked to APM services, traces, and spans.

Next steps

• To learn how to create global data links for Splunk Application Performance Monitoring (APM) properties, see Link APM services, traces, and spans to relevant resources.

• To learn how data links behave when multiple data links are available for a property, see Select a property value to follow a link.