I was wondering if there's any way to give users a link to download a file from a splunk server (without setting up a separate web server on the same box). Basically, I want the user to be able to click an event in my dashboard (a cell in a table), which should link to a related file on the server. I was thinking something along the lines of using Splunk's ServerSideInclude module or SideView's HTML module to link to an HTML file which has a download link for the file, or something along those lines. Perhaps SideView's URLLoader or Redirector modules could dynamically link to the file path? Does anyone know if something like this would work, or if Splunk or SideView Utils has the capability to download files for a user at all? I'm really just fishing for ideas here.
Any help is appreciated. Thanks in advance.
Well to keep it simple, if you can get the file to /appserver/static, then you can just make a link using a Sideview HTML module or a Splunk ServerSideInclude module. HTML module is a little more flexible cause you can incorporate dynamic bits and pieces with $foo$ tokens, and because you can either embed the HTML with the "html" param or pull it from appserver/static with the "src" param.
the URL structure on SplunkWeb can take some getting used to, but the short answer, is that to have a link in a view, that points to some file sitting in appserver/static on the same, app, the link should look like:
<a href="../../static/app/YOUR_APP/YOUR_FILE">download file</a>
Thanks, this is pretty close to what I'm looking for. Is there any way I could have a cell in a Table module link to the file as its drilldown behavior? What I'm looking for exactly is the ability for the user to click on that cell in the table, which then downloads the file for them (the name of which corresponds to the text being clicked in the table, which is why I was asking about dynamic linking).
Yes. what people do is use the "Table Embedding" feature of the Table module. there are good docs and working examples of this feature in the Table section of the Sideview Utils docs. And embedding a single HTML module is the most common use case for Table Embedding.
In short you'll embed a download link into every row, and clicking on the link in the given row will download the file.
I also recommend making an icon for the link. And not using the generic row-drilldown feature for anything here but using an embedded link+icon instead. More clear to the user that way.
Definitely getting very close. One more annoying question! 🙂
I'm having a problem getting the link to work now. When I put in your suggestion, I got "The path '/en-US/app/static/app/MYAPP/MYFILE' was not found. It looked like "app" was getting repeated, so I tried various other combinations, most of which resulted in the same 404 not found error.
However, one of them (../../appserver/static/MY_FILE) resulted in the following error: " KeyError: u'static' ". This was classified as a 500 Internal Server Error. I'm wondering if I got the right link but there's another problem. Help or ideas?
../../static/app/YOUR_APP/YOUR_FILE from a view should work just fine. We do it all the time across lots of apps.
What it sounds like though, is that you only have one "../" at the start of your URL. Can you double check that? If you only had one then you would indeed end up at /en-US/app/static/app/MYAPP/MYFILE, which is indeed not a valid path.
Also the second attempt isn't a valid path either. The routing in cherrypy is a little odd so in some places instead of 404 it'll return 500. it's no big deal.
I did have the two "../", but I decided to try and add a third one, and it worked! I don't know why mine is different, but for some reason, I needed an extra "../", ultimately resulting in "../../../static/app/MYAPP/MYFILE". Thank you very much for your help throughout this problem.
Oh interesting... actually, weird! And this was just using the html or src param of an HTML module? What splunk version? If you have time and inclination, I'd be curious to see your xml. You can email it to support [at] sideviewapps.com
Unfortunately, I am not at liberty to share my full xml. The relevant Table module is:
Splunk version 5.0.3, build 163460
SideView Utils version 2.4.10
Hope this helps.
(* was added to prevent an actual html link from appearing)