topic Re: How to make table structure in link format in Dashboards & Visualizations

How to make table structure in link format?

aditsss — Mon, 31 Jul 2023 18:20:02 GMT

Hi Team,

I have used below query:

index="abc*" sourcetype=600000304_gg_abs_ipc2 sourcetype = "600000304_gg_abs_ipc2" " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData" source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" |rex " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData totalOutputRecords=(?<totalOutputRecords>), totalInputRecords=(?<totalInputRecords>),busDt=(?<busDt>),fileName=(?<fileName>),totalClosingBal=(?<totalClosingBal>)"|table _time totalOutputRecords totalInputRecords busDt fileName totalClosingBal

I have displayed the result in tabular format as shown below:

I want this to be in hyperlink format Can anyone please guide:

Re: How to make table structure in link format

richgalloway — Fri, 28 Jul 2023 17:11:07 GMT

What do you mean by "hyperlink format"? What are you linking to? What do you expect the output to look like?

Re: How to make table structure in link format

aditsss — Fri, 28 Jul 2023 17:50:35 GMT

@richgalloway

I want to show in link format or some underline format not plane table

Re: How to make table structure in link format

richgalloway — Fri, 28 Jul 2023 18:45:29 GMT

That response answers none of my questions. Please help me help you by provided the requested information.

Underlining is performed by the browser when it finds a URL.

Nothing in the example table lends itself to hyperlinking. There is no domain name to connect to so any links created would be invalid. They would look like this

https:///?_time=2023-07-06 08:44:06.168&totalOutputRecords=19011600&totalInputRecords=0&busDt=07/25/2023&fileName=SETTLEMENT_TRANSFORM_MERGE&totalClosingBal=8.51272677817E10

URL encoding will fix some of the problems with this link, but the lack of a destination is a non-starter.

Re: How to make table structure in link format

aditsss — Fri, 28 Jul 2023 18:48:36 GMT

@richgalloway

I want to create one hyperlink on clicking of which it will take to raw logs:

current code:

Re: How to make table structure in link format

richgalloway — Fri, 28 Jul 2023 19:19:51 GMT

Now I'm starting to understand the use case.

Normally, a dashboard panel presents data in a simplified form and then offers a drilldown into more specific information. In this case, the table is the simple form and the drilldown would be to the raw data. The drilldown is the "hyperlink" you seek. Data in the table will not be underlined so users would have to be educated about the drilldown's availability (perhaps in the panel description).

<row> <panel> <table> <search> <query>index="abc*" sourcetype=600000304_gg_abs_ipc2 sourcetype = "600000304_gg_abs_ipc2" " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData" source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" |rex " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData totalOutputRecords=(?<totalOutputRecords>), totalInputRecords=(?<totalInputRecords>),busDt=(?<busDt>),fileName=(?<fileName>),totalClosingBal=(?<totalClosingBal>)"|table _time totalOutputRecords totalInputRecords busDt fileName totalClosingBal</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">all</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <link target="_blank">search?q=index="abc*" sourcetype=600000304_gg_abs_ipc2 sourcetype = "600000304_gg_abs_ipc2" " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData" source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" _time=$row._time$ |rex " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData totalOutputRecords=(?<totalOutputRecords>), totalInputRecords=(?<totalInputRecords>),busDt=(?<busDt>),fileName=(?<fileName>),totalClosingBal=(?<totalClosingBal>)" | where (totalOuputRecords=$row.totalOuputRecords$ AND totalInputRecords=$row.totalInputRecords$ AND busDT=$row.busDT$ AND fileName=$row.fileName$ AND totalClosingBal=$row.totalClosingBal$)</link> </drilldown> </table> </panel> </row>

The drilldown link will have to be URL-encoded, but the dashboard editor UI will do that for you.

Re: How to make table structure in link format

gcusello — Sat, 29 Jul 2023 05:23:47 GMT

Hi @aditsss,

as @richgalloway said it isn0t clear what you mean with hyperlink.

If you mean that you want to drilldown opening a new search page or dashboard, you have to explore the drilldown feature.

this is a video that explain how to do it: https://www.google.com/search?q=Splunk+dashboard+drilldown&rlz=1C1VDKB_itIT1048IT1048&biw=1920&bih=923&sxsrf=AB5stBgE4HA2DoY7LuDD0u4ZSgTUVBIaIw%3A1690608172572&ei=LKLEZO7AIvmC9u8Pvr60qAk&ved=0ahUKEwjuhtKclrOAAxV5gf0HHT4fDZUQ4dUDCA8&uact=5&oq=Splunk+dashboard+drilldown&gs_lp=Egxnd3Mtd2l6LXNlcnAiGlNwbHVuayBkYXNoYm9hcmQgZHJpbGxkb3duMgQQIxgnMggQABiABBjLATIIEAAYgAQYywEyCBAAGIAEGMsBMggQABiABBjLATIIEAAYgAQYywEyBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHkjEDFDyBVjWB3ABeAGQAQCYAXCgAd8BqgEDMC4yuAEDyAEA-AEBwgIKEAAYRxjWBBiwA-IDBBgAIEGIBgGQBgY&sclient=gws-wiz-serp#fpstate=ive&vld=cid:d6fea490,vid:q26Sec8iYSs

Ciao.

Giuseppe

Re: How to make table structure in link format

ITWhisperer — Sat, 29 Jul 2023 07:33:45 GMT

You could add css to make the data appear like a link, but which field would you apply that to?

Here is a solution to another question showing this, but you would have to adapt it to suit your needs

Re: Highlight different values table Column in Spl... - Splunk Community

Re: How to make table structure in link format

aditsss — Sun, 30 Jul 2023 07:53:04 GMT

Hi @richgalloway @ITWhisperer

I tried like this below:

<row>
<panel>
<table>
<search>
<query>index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2 sourcetype = "600000304_gg_abs_ipc2" " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData" source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" |rex " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData totalOutputRecords=(?<totalOutputRecords>), totalInputRecords=(?<totalInputRecords>),busDt=(?<busDt>),fileName=(?<fileName>),totalClosingBal=(?<totalClosingBal>)"|table _time totalOutputRecords totalInputRecords busDt fileName totalClosingBal</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<link target="_blank">search?q=index="600000304_d_gridgain_idx*" sourcetype = "600000304_gg_abs_ipc2" " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData" source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" _time=$row._time$ |rex " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData totalOutputRecords=(?<totalOutputRecords>), totalInputRecords=(?<totalInputRecords>),busDt=(?<busDt>),fileName=(?<fileName>),totalClosingBal=(?<totalClosingBal>)" | where (totalOuputRecords=$row.totalOuputRecords$ AND totalInputRecords=$row.totalInputRecords$ AND busDT=$row.busDT$ AND fileName=$row.fileName$ AND totalClosingBal=$row.totalClosingBal$)</link>
</drilldown>
</table>
</panel>
</row>

I am getting output like this:

But clicking on it its not showing drilldown or raw logs

Could you please guide

Re: How to make table structure in link format

aditsss — Sun, 30 Jul 2023 10:46:28 GMT

@ITWhisperer @richgalloway

Could you please guide here

Re: How to make table structure in link format

richgalloway — Mon, 31 Jul 2023 12:17:04 GMT

Two things to try:

1) Run the drilldown query in a search window by itself to verify it works. Make changes as necessary then transfer the resulting query back to the dashboard.

2) Enter the drilldown query using the Dashboard Editor UI rather than by editing the dashboard source directly. This will ensure the query is properly encoded.