Link metadata to related resources using global data links 🔗
Global data links let you link metadata displayed in Splunk Observability Cloud to the following relevant resources:
Dashboards in Splunk Observability Cloud
Navigators in Splunk Observability Cloud
Splunk Cloud Platform and Splunk Enterprise
Custom URLs
Kibana logs
Splunk RUM
In Splunk Observability Cloud, metadata (data about your data) includes dimensions, properties, and tags. Metadata displays in the following locations in the product:
Alerts
Dashboards and Splunk Infrastructure Monitoring navigators, in the following locations:
List charts
Line charts
Area charts
Column charts
Data tables
Splunk Application Performance Monitoring (APM), in the following locations:
Services
Traces
Spans
For example, here is a global data link displaying for a host property on a dashboard. The global data link leads to an EC2 Cost and Usage dashboard in Splunk Observability Cloud, where the system automatically narrows the dashboard is automatically show data that’s relevant to the server4 host.
For more examples of global data links displayed in context, see Access global data links.
Global data links dynamically transfer contextual information about the metadata you’re viewing to the linked resource, helping you get to relevant information faster.
When you create a global data link, it appears wherever the designated metadata is visible in dashboards, Splunk Infrastructure Monitoring navigators, Splunk APM, and alert messages. All users who can see the metadata can see the global data link.
By contrast, when you create a local data link, it is only available on the dashboard or navigator you created it on. All users who can see the metadata can see the local data link. For more information about local data links, see Navigate to related resources with data links.
Prerequisite 🔗
You must be an administrator to create global data links.
For information about granting administrative access, see Create and manage users in Splunk Observability Cloud.
Create a global data link 🔗
This procedure describes how to create a global data link for any available metadata using the Global Data Link page.
For information about how to create a global data link using the Splunk Observability Cloud API, see the Link Metadata to Related Content topic in the Splunk Observability Cloud Developer Guide.
For information about how to create a global data link for Splunk APM properties, see Link APM services, traces, and spans to relevant resources.
Open the Splunk Observability Cloud navigation Menu.
Hover over Data Configuration and select Global Data Links.
Select New Link.
In the Link Label field, enter the text you want to display as the global data link text.
In the Link to field, select your link target type. Select from the following targets for your global data link:
Custom URL: Links to a custom URL.
Splunk: Links to Splunk Cloud Platform or Splunk Enterprise.
Splunk Observability Cloud Navigator: Links to a navigator in Splunk Observability Cloud. Select Choose Navigator to select the navigator you want to link to.
Splunk Observability Cloud Dashboard: Links to a dashboard in Splunk Observability Cloud. Select Choose Dashboard to select the dashboard you want to link to.
Kibana: Links to a Kibana log.
In the Show On list, select a value that indicates where you want the global data link to display:
Any Metadata Value: Display the link for any metadata value. This option isn’t available if you set the Link to field to Splunk Observability Cloud Dashboard.
Any Value of: Display the link for any value of a specific piece of metadata.
For example, select Any Value of and enter aggregration_type to display the link for any aggregration_type value.
Property:Value Pair: Display the link for a specific value of a specific piece of metadata.
For example, select Property:Value Pair and enter aggregration_type:average to display the link only for an aggregation_type value of average.
If you want the link to display based on the Show On value and one or more additional conditions, select Add Conditions. If you define multiple conditions, the link only displays if all the conditions are true.
For details about how to use the Any Value of and Property:Value Pair options, see the previous step.
If you set the Link to field to Custom URL, Splunk, or Kibana, the URL field displays. Enter the URL you want the global data link to lead to.
Optionally, for Custom URL and Kibana link target types, you can use any of the following placeholder variables in your URL. When you select the global data link, the system replaces the variables with actual values to create the destination URL.
{{key}}: Use this variable to populate the key name from the context where the link displays. For example, if you set Show on to aggregation_type,aggregation_typereplaces{{key}}in the URL.{{value}}: Use this variable to populate the key value from the context where the link displays. For example, if you set Show on to aggregation_type and the aggregation_type value in context is average,averagereplaces{{value}}in the URL.{{start_time}}: Use this variable to populate the start time of the time window from the context where the link displays. The system inserts the timestamp using the format you select in the Time Format field.{{end_time}}: Use this variable to populate the end time of the time window from the context where the link displays. The system inserts the timestamp using the format you select in the Time Format field.{{properties.<property_name>}}: Use this variable to populate other metadata from the context of the link display. For example,propertiescontains a map of the metadata key names and values that appear in the context of the global data link display. To insert a name and value from this map, use{{properties.<your_property_name>}}. If your property name has a period in it, use square brackets around the value. For example,{{properties.[<property.name>]}}.
If you select a Link to value of Custom URL or Kibana, the Time Format field appears. Set this field to select the timestamp format used for the global data link’s starting and ending timestamps. Setting this field also helps ensure compatibility with the external system you are linking to. Select one of the following time formats:
ISO 8601: YYYY-MM-DDThh:mm:ss.SSSZ
Unix Time: epoch milliseconds
Unix Time: epoch seconds
If you select a Link to value of Custom URL, Splunk, or Kibana, the Minimum Time Window field appears. The time window is the interval during which the system captured the chart, dashboard, service map, or trace data. If this interval is shorter than the minimum time window value you select here, the global data link adjusts the start time to an earlier time so the interval is as long as the minimum time window.
If you select a Link to value of Custom URL, Splunk, or Kibana, the Property mapping options appear. Use property mapping if your URL value contains Splunk Observability Cloud key names and values that are referred to differently in the external system you’re linking to.
For example, you can use property mapping to map a Splunk Observability Cloud key name, such as host, to an external system key name, such as hostname. You can also use property mapping to map an Observability key name, such as host, and key value, such as west-internal-123456, to an external system key name, such as hostname, and key value, such as 123456-west-int.
To use property mapping, select Choose a Property to select a Splunk Observability Cloud key name or key name and value pair. Then, enter the external key name or key name and value pair that you want to map to in the External Term field.
Select Save.
Alternatively, here are some other locations in Splunk Observability Cloud where you can access the ability to create global data links:
When you view an alert message that includes data links, select the More menu (⋯) next to a data link and select Configure data links.
When you are on a dashboard, select Data Links from the Dashboard actions menu. If there are existing global data links defined for your organization, you can see a message to that effect on the Data Links tab. Select Global Data Links.
When you view a list in a Splunk Infrastructure Monitoring navigator, select the Actions menu for any property and select Configure data links.
To create a global data link when you create a data link from a dashboard, select a scope of Entire Organization.
Example custom URL global data link configuration 🔗
To illustrate the field values you enter on the Global Data Links page, here’s an example configuration for a global data link to a custom URL:
This global data link displays for the aggregation_type metadata on a dashboard, as shown here:
When you select the global data link, the URL you defined on the Global Data Links page immediately appears. For example, consider the URL defined in following example:
https://www.example.com/search/?field={{key}}&value={{value}}&service={{properties.unit}}&st={{start_time}}&et={{end_time}}
When you select the global data link for an aggregation_type metadata value of total, the URL appears in the following form:
https://www.example.com/search/?field=aggreg-type&value=ttl&service=Bytes&st=2021-09-02T01:13:30.000Z&et=2021-09-02T01:18:30.000Z
For more global data link configuration examples, see the following topics. While these topics are specific to Splunk APM properties, you can apply the guidance to any property:
Access global data links 🔗
After you’ve created a global data link, it displays for your specified metadata in any of the following relevant areas of Splunk Observability Cloud. While you must be an administrator to create a global data link, anyone can access the global data links you create.
Data tables 🔗
For information about data tables, see View the Data Table tab.
List charts 🔗
For information about list charts, see List charts.
Alert messages 🔗
For information about alerts, see View alerts in Splunk Observability Cloud.
Service names and trace IDs in Splunk Application Performance Monitoring (APM) 🔗
For more information about accessing global data links in Splunk APM, see Access relevant resources linked to APM services, traces, and spans.
Next steps 🔗
To learn how to create global data links for Splunk Application Performance Monitoring (APM) properties, see Link APM services, traces, and spans to relevant resources.
To learn how data links behave when multiple data links are available for a property, see Select a property value to follow a link.