topic Re: How to give link to raw data for last 15 minutes to run everytime when the hyperlink is selected in Dashboards & Visualizations

How to give link to raw data for last 15 minutes to run everytime when the hyperlink is selected

vrmandadi — Mon, 22 Jan 2018 20:24:30 GMT

I am creating a dashboard which has link to all the different sourcetypes,the dashboard has the sourcetype name a description and a hyperlink which on click should open in a new tab and run in verbose mode for the last 15 mins for that particular sourcetype.Below is the way I have done but not successfull.

          <a href="https://splunk.vap.rr.com/en-US/app/myapp/search?earliest=-15m&latest=now&q=search%20index%3Dvap%20sourcetype%3Dad_it_message%20host%3D%22*ads-broker*%22&display.page.search.mode=verbose&dispatch.sample_ratio=1&display.general.type=events&display.page.search.tab=events&sid=$results.sid$" target="_blank" alt="Click here to view the Data" title="Click here to view the Data">Ad Router</a>

Thanks in Advance

Re: How to give link to raw data for last 15 minutes to run everytime when the hyperlink is selected

nickhills — Mon, 22 Jan 2018 20:34:31 GMT

have you tried $results.row.sid$

Re: How to give link to raw data for last 15 minutes to run everytime when the hyperlink is selected

vrmandadi — Mon, 22 Jan 2018 20:44:32 GMT

Ya I tried this but it is showing me error "Invalid character entity" ,It is accepting if I give https://splunk.vap.rr.com/en-US/app/vams/search?earliest=-15m&latest=now ,but not the whole thing

https://splunk.vap.rr.com/en-US/app/vams/search?earliest=-15m&latest=now&q=search%20index%3Dvap%20sourcetype%3Dadrouter_audit_message%20host%3D%22*ads-broker*%22&display.page.search.mode=verbose&sid=$results.row.sid$&dispatch.sample_ratio=1

Re: How to give link to raw data for last 15 minutes to run everytime when the hyperlink is selected

nickhills — Mon, 22 Jan 2018 20:52:22 GMT

Do you even need to pass the sid if your running a normal search? - I first read this as you were linking to a scheduled search, but on second read, I don't think you need this.

You probably just 'need'
https://splunk.vap.rr.com/en-US/app/myapp/search?earliest=-15m&latest=now&q=search%20index%3Dvap%20sourcetype%3Dad_it_message%20host%3D%22*ads-broker*%22&display.page.search.mode=verbose

Re: How to give link to raw data for last 15 minutes to run everytime when the hyperlink is selected

vrmandadi — Mon, 22 Jan 2018 21:02:10 GMT

Got the following error Error parsing XML on line 55: EntityRef: expecting ';'

Re: How to give link to raw data for last 15 minutes to run everytime when the hyperlink is selected

nickhills — Mon, 22 Jan 2018 21:09:03 GMT

Sadly, I don't have access to a working splunk instance at the moment, but i would suspect there is a typo or a quoting issue in the url - run the search you want, then copy the url from your browser address bar and compare them.

Re: How to give link to raw data for last 15 minutes to run everytime when the hyperlink is selected

vrmandadi — Wed, 24 Jan 2018 01:16:06 GMT

Can we do this CDATA ?

Re: How to give link to raw data for last 15 minutes to run everytime when the hyperlink is selected

vrmandadi — Fri, 26 Jan 2018 18:21:22 GMT

Ii figured it out

https://splunk.vap.rr.com/en-US/app/myapp/search?earliest=-15m&latest=now&display.page.search.mode=verbose&q=search%20eventtype%3Daudit

using amp; near the & so that xml does not treat as invalid character

Re: How to give link to raw data for last 15 minutes to run everytime when the hyperlink is selected

niketn — Fri, 26 Jan 2018 18:29:02 GMT

@vrmandadi please accept the same to mark this as answered! If you are on Splunk Enterprise 6.6 or higher, you could have created link to search interactively from Dashboard which would have escaped & character automatically. Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/DrilldownLinkToSearch#Configure_the_drilldown_in_the_drilldown_editor