Choose a data link type

There are two types of data links for a property, local and global. See the following table to choose the appropriate data link type.

Configure local data links

When you view properties in a chart on a dashboard, either in the data table or on a list chart, you can configure local data links by using the Actions menu. The following steps show you how to create a new local data link:

1. Hover over the property and select the (⋯) icon.

2. Select Configure data links to display the Data Links tab.

3. Select New Link to display the link configuration options. If the New Link button is not available, you don’t have write permission for the dashboard and can’t create local data links.

4. Add a label for the link. This label is what the user sees in a property’s Actions menu, so use a concise and clear label.

5. Select the type of destination to link to:

   • Infrastructure Monitoring Navigator: You have to select the navigator in a following step.

   • Infrastructure Monitoring Dashboard: You have to select the dashboard in a following step.

   • Splunk: A Splunk search for a property:value pair.

   • Kibana: You have to create the URL template for the link in a following step.

   • Custom URL: Any URL-addressable destination.

6. In the Show On drop-down menu, select a value that indicates where you want the data link to display.

   • Any Metadata Value: Link from all values of all properties. (Not available for Dashboard destinations.)

   • Any Value of: Link from any value of a property. The property you start from is pre-filled as the trigger, but you can delete it and select a different trigger.

   • Property:Value Pair: Link from a specific value of a property. The property:value you start from is pre-filled, but you can delete it and select a different trigger.

7. If you want the data link to display based on the Show On value and one or more additional conditions, select Add Conditions. If you define multiple conditions, you must meet all conditions for the link to display.

8. Choose the scope of visibility of this link. You can choose:

   • Entire Organization (available only for administrators): Use this option to create a global data link instead of a local data link.

     For more information about global data links, see Link metadata to related resources using global data links.

   • This Dashboard Only: This link is available only on charts in the current dashboard.

9. Configure the actual destination for your link, depending on the type of destination you chose.

   • If your destination is a dashboard, select Choose Dashboard, search for the target dashboard, then select OK.

     • If the target dashboard is in the same dashboard group as the source dashboard, any filters that you apply on the source dashboard are preserved on the destination dashboard.

     • If the link uses the Any Metadata Value or Any Value of option, the property value that you select is also applied as a filter on the destination dashboard.

     • If the link uses the Property:Value Pair option, the assumption is that the destination dashboard is already specific to that value, and the property value that you select isn’t applied as a filter on the destination dashboard. For example, if the trigger is service:analytics, the target dashboard must be specific to the analytics service, with any appropriate filters already applied.

   • If your destination is a Splunk instance, enter the instance URL in the URL field. The property:value information is passed to Splunk.

   • If your destination is a custom URL or Kibana, enter the full address of the URL in the URL field. You can insert variables to vary the resulting URL by property values. Available values are shown when you select the URL field. Common variables and associated syntax include:

     • start and end time: &st={{start_time}}&et={{end_time}}

     • property name (key) and value for the trigger: &field={{key}}&value={{value}}

     • value of any property (for example, host): &host={{properties.host}}

     You can also choose the time format of the start_time and end_time variables, as well the minimum time window between them.

10. (optional) If your destination is a custom URL, Splunk instance, or Kibana, you can use Property Mapping to dynamically rename a key or key:value pair in the URL. Use this if you want to link to a destination that has similar data, but different names for the properties that appear in your dashboard.

11. Select Save to create the new link.

The link now appears on the Actions menu for the property.

Select a property value to follow a link

If a link target is an Infrastructure Monitoring dashboard, you can follow a link by selecting on the property value. When multiple links to dashboards are available for a property, the application selects which link to follow based on the following order of operations.

More specific data links override less specific data links

If multiple links that go to Infrastructure Monitoring dashboards are triggered by the same property, selecting the linked value goes to the destination for the trigger that is most specific to that value. In other words, a trigger on a property:value pair is more specific than a trigger on any value of a property.

For example, suppose Link A is a local data link triggered by any value of service, and Link B is a global data link triggered by service:analytics.

• Selecting service:analytics in that dashboard follows Link B because the global data link is more specific than the local data link.

• Selecting any other value of service in that dashboard, such as service:testing, follows Link A.

Local data links override equally specific global data links

If a property has equally specific local and global data links that go to Infrastructure Monitoring dashboards, selecting the property value navigates to the local link.

For example, suppose Link C is a local data link triggered by service:analytics with a destination of Dashboard X; link D is a global data link also triggered by service:analytics, with a destination of Dashboard Y.

• Selecting service:analytics in that dashboard follows the local data link to Dashboard X because the local data link overrides the global data link.

• Selecting service:analytics in a different dashboard or in an alert message follows the global data link to Dashboard Y.

Default links override non-default links

If there are multiple, equally-specific triggers that go to Infrastructure Monitoring navigators or dashboards for a property, selecting the property value follows the link that has been specified as the default.

For example, suppose two links are triggered by any value of host, but they have different destination navigators or dashboards. One link is designated as the default; selecting any value of host follows the link to the default destination.

To change the default link for a trigger, expand the link for the desired default destination so you can see its settings, then open the Actions menu and select Make default.

Use and view data links

If data links are available in your organization, you have access to them from a number of locations in Splunk Infrastructure Monitoring.

• When a property has a data link with an Infrastructure Monitoring dashboard as the target, hovering over the property displays the cursor pointer. A tooltip indicates the dashboard you can navigate to if you select the property; the dashboard group is shown in parentheses.

  

• Alternately, you can view available data links in the Actions menu for any property. To access the Actions menu, hover over a property and select the (⋯) icon that appears. If there are data links defined for the property, the list of links is displayed when you select the (⋯) icon, and you can navigate to any of them from this menu.

  Note: To navigate to targets other than dashboards, you must use the Actions menu.

• To view all the local data links for a dashboard, select Data Links from the Dashboard actions menu.

• To view all the global data links for an organization, go to Navigation menu > Data Configuration, then select Global Data Links. Alternately, you can select Global Data links when viewing the list of local data links.

About defining data links

• You can define multiple data links for a property.

• If a link target is a Splunk Infrastructure Monitoring dashboard, you can follow the link by selecting the property value.

• If a property is linked to multiple target navigators or dashboards, a few factors determine which navigators or dashboards are opened when you select the property value; see Select a property value to follow a link.

• If your organization has the permissions feature available, you can define or remove local data links only if you have write permissions for the source dashboard. However, you don’t need write permissions for the target dashboard. To learn more, see Read and write permissions in Splunk Infrastructure Monitoring.

• You must be an administrator to define or remove global data links. However, anyone can view the list of existing global data links.

• If you create a link from a location other than a chart, such as from a navigator or an alert message, you can only create a global data link.