topic Re: How do I enable URL links in output in Dashboards & Visualizations

How do I enable URL links in output

mpatnode — Wed, 27 Oct 2010 02:19:58 GMT

I have a table in which one column is text which may or may not include a URL. (Think like a twitter feed). Is there an easy way to make the URL's clickable or do I need to format the text somehow?

Re: How do I enable URL links in output

araitz — Wed, 27 Oct 2010 05:12:01 GMT

There is no way that I know of to do this with the current table modules. You would need to super one of the existing table modules or roll your own special module.

Re: How do I enable URL links in output

mpatnode — Thu, 04 Nov 2010 03:28:30 GMT

OK. I'll bite. Have a pointer or example of extending one of the existing table modules? I'm also missing the connection from

in my panel XML file and the registered module list: http://mysplunk:8000/modules. It seems a table is made from multiple modules?

Re: How do I enable URL links in output

mpatnode — Sat, 13 Nov 2010 04:28:27 GMT

So I used a big hammer to simply copy all the SimpleResultsTable files in $SPLUNKHOME/share/splunk/search_mrsparkle/modules/results to URLResultsTable and then added the following code (stolen from here: http://stackoverflow.com/questions/1112012/replace-url-with-a-link-using-regex-in-python)

import re

....

PAT1 = re.compile(r"(^|[\n ])(([\w]+?://[\w#$%&~.-;:=,?@[]+])(/[\w#$%&~/.-;:=,?@[]+])?)", re.IGNORECASE | re.DOTALL)

PAT2 = re.compile(r"#(^|[\n ])(((www|ftp).[\w#$%&~.-;:=,?@[]+])(/[\w#$%&~/.-;:=,?@[]+])?)", re.IGNORECASE | re.DOTALL)

...

An then right before the return of generateResults()

    # Convert URLs to links
    output = PAT1.sub(r'\1<a href="\2" target="_blank">\2</a>', output)
    output = PAT2.sub(r'\1<a href="http:/\2" target="_blank">\2</a>', output)
    return output

It sounds like this might be easier to do in application.js, but I'm not sure how to filter the entire output stream from there.

Re: How do I enable URL links in output

araitz — Sat, 13 Nov 2010 06:33:08 GMT

Check out the FireEye app on Splunkbase: http://splunkbase.splunk.com/apps/All/4.x/App/app:FireEye. There are some examples of making table rows clickable using application.js.

Re: How do I enable URL links in output

sideview — Thu, 17 Jan 2013 07:39:53 GMT

Note that this becomes quite easy if you use the Sideview Table module instead of the SimpleResultsTable module, and it doesn't require writing a custom module or any custom code at all.

Say your field was called "url", and say it was a fully formed URL, including the http:// and all that. All you would use is the following XML in your view:

<module name="Table">  
  <module name="HTML" group="row.fields.url">
    <param name="html"><![CDATA[
      <a href="$row.fields.url$">$row.fields.url$</a>
    ]]></param>
  </module>
</module>

There are docs about this feature within Sideview Utils itself. Note that you'll need a relatively recent version of Sideview Utils (currently 2.3) from the Sideview site ( http://sideviewapps.com/apps/sideview-utils ) and not the older version available on Splunkbase.

Once you get the app installed/upgraded, you can find those docs under "Module Documentation > The Table Module > Table - Embedding Examples".

To paraphrase the official docs though, if the Table finds itself with any module immediately downstream that has a group attribute matching "row.fields.someField", and it finds that it actually has a field called "someField" in the results it's rendering, then instead of rendering ordinary text as the contents of those tablecells, it will process and render the given module config. In this case we've given it just a simple HTML module, and as you can see we tell it to render a link in the tablecell instead.