topic Re: Replace URL string with a hyperlink in splunk in Splunk Search

How to replace URL string with a hyperlink in splunk?

aditsss — Tue, 25 Aug 2020 01:11:35 GMT

Hi Everyone,

I have a search query as below:

index=xyz sourcetype=uio source="user.log" process (Type ="*") (Name_Id ="*") (Request_URL ="*")| convert timeformat="%Y-%m-%d" ctime(_time) AS Date|stats count by Date Name_Id Type Request_URL

I am getting the data for Date Name_Id Type Request_URL

There are multiple Request_URL's .Some of the samples are

https://xyz/api/flow/process-groups/0a4ffa54-c204-3e9e-a16d-83a4845f83a7

https://uio/api/flow/process-groups/1b6877ea-0174-1000-0000-00003d8351cd

I want one more column (Any name) in my search query.Which will Replace Request_URL string like this.

This new column should be hyperlink.

https://abc.com/api/?processGroupId=0a4ffa54-c204-3e9e-a16d-83a4845f83a7

https://abc.com/api/?processGroupId=1b6877ea-0174-1000-0000-00003d8351cd

I want to display both Request_URL and this new column in my search data

Its like whenever Request_URL https://xyz/api/flow/process-groups/0a4ffa54-c204-3e9e-a16d-83a4845f83a7 will come . The new column which will be hyperlink should be this https://abc.com/api/?processGroupId=0a4ffa54-c204-3e9e-a16d-83a4845f83a7.

I want both to get displayed.

Can someone guide me on that.

Thanks in advance.

Re: Replace URL string with a hyperlink in splunk

Nisha18789 — Mon, 24 Aug 2020 17:59:05 GMT

Hi @aditsss , can you try this

index=xyz sourcetype=uio source="user.log" process (Type ="*") (Name_Id ="*") (Request_URL ="*")| convert timeformat="%Y-%m-%d" ctime(_time) AS Date|stats count by Date Name_Id Type Request_URL

|rex field=Request_URL "\/(?<param>.[0-aA-Z0-9-][^\/]+)"

| eval hyperlink="https://abc.com/api/?processGroupId="+param

| fields - param

Re: Replace URL string with a hyperlink in splunk

aditsss — Mon, 24 Aug 2020 18:30:28 GMT

Hi,

I made the changes in my search query as below:

index=xyz sourcetype=uio source="user.log" process (Type ="*") (Name_Id ="*") (Request_URL ="*")| convert timeformat="%Y-%m-%d" ctime(_time) AS Date

|rex field=Request_URL "\/(?<param>.[0-aA-Z0-9-][^\/]+)"

| eval hyperlink="https://abc.com/api/?processGroupId="+param

|stats count by Date Name_Id Type Request_URL param hyperlink

I am able to get new column but Its not clickable. When I right click on it hyperlink is not opening.

Re: Replace URL string with a hyperlink in splunk

Nisha18789 — Mon, 24 Aug 2020 18:32:39 GMT

hello @aditsss , are you trying to use this data in a dashboard or email alert?

Re: Replace URL string with a hyperlink in splunk

aditsss — Mon, 24 Aug 2020 18:41:14 GMT

Hi Nisha18789,

As of now I am using in my search Query.

On search window I have open this query. I want that when I click on new column It should open hyperlink in new tab.

I am able to get hyperlink the way you told .But its not clickable.

Can u guide me on that.

Re: Replace URL string with a hyperlink in splunk

aditsss — Mon, 24 Aug 2020 19:31:14 GMT

Hi ,

I have but the data in dashboard. Can you guide me how to make it hyperlink now.

<dashboard>
<label> Panel 2</label>
<row>
<panel>
<table>
<search>
<query>

index=xyz sourcetype=uio source="user.log" process (Type ="*") (Name_Id ="*") (Request_URL ="*")| convert timeformat="%Y-%m-%d" ctime(_time) AS Date|rex field=Request_URL "\/(?<param>.[0-aA-Z0-9-][^\/]+)"| eval hyperlink="https://abc.com/api/?processGroupId="+param|stats count by Date Name_Id Type Request_URL param hyperlink

</query>
<earliest>-1d@d</earliest>
<latest>@d</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">no</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard>

Re: Replace URL string with a hyperlink in splunk

Nisha18789 — Tue, 25 Aug 2020 06:26:55 GMT

hi @aditsss , this should help

<dashboard>
<label>Panel 2</label>
<row>
<panel>
<table>
<search>
<query>index=xyz sourcetype=uio source="user.log" process (Type ="*") (Name_Id ="*") (Request_URL ="*")| convert timeformat="%Y-%m-%d" ctime(_time) AS Date|rex field=Request_URL "\/(?<param>.[0-aA-Z0-9-][^\/]+)"| eval hyperlink="https://abc.com/api/?processGroupId="+param|stats count by Date Name_Id Type Request_URL param hyperlink</query>
<latest>@d</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<fields>["Name_Id","Type","Request_URL","hyperlink","count"]</fields>
<drilldown>
<condition field="hyperlink">
<link target="_blank">https://abc.com/api/?processGroupId=$row.param$</link>
</condition>
</drilldown>
</table>
</panel>
</row>
</dashboard>

Re: Replace URL string with a hyperlink in splunk

aditsss — Tue, 25 Aug 2020 03:30:46 GMT

Hi, Seems like condition field is not working for me.

I have tried something like this but taking each and every column to that hyperlink.

I want only new column should take me to that server . Not every column.

<dashboard>
<label>Panel 2</label>
<row>
<panel>
<table>
<search>
<query>index=xyz sourcetype=uio source="user.log" process (Type ="*") (Name_Id ="*") (Request_URL ="*")| convert timeformat="%Y-%m-%d" ctime(_time) AS Date|rex field=Request_URL "\/(?<param>.[0-aA-Z0-9-][^\/]+)"| eval hyperlink="https://abc.com/api/?processGroupId="+param|stats count by Date Name_Id Type Request_URL param hyperlink</query>
<latest>@d</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<fields>["Name_Id","Type","Request_URL","hyperlink","count"]</fields>
<drilldown>
<link target="_blank">https://abc.com/api/?processGroupId=$row.param$</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>

Re: Replace URL string with a hyperlink in splunk

Nisha18789 — Tue, 25 Aug 2020 06:28:48 GMT

@aditsss , there was a typo in the condition field name, I have updated my response(in bold) can you try now?

Re: Replace URL string with a hyperlink in splunk

aditsss — Tue, 25 Aug 2020 18:36:13 GMT

Thank you Nisha18789 . It works.