If the event has a URL and you want to show the URL in a search table where you can make the URL a clickable link that will go to that URL, how do you do this?
Example: Field is URL in the event and you want to display that URL in a table search aka index = ... | table URL
I want to be able to click on that URL and go to the link as to having to copy the URL and manually paste it into a browser.
Is there a way to do this in the generic search results? AKA not via a dashboard?
No matter what I put in the field value it only lets me click it say "include/exclude in search results" and I'm thinking there's no way to override this.
<link> - No
<a href="> No
Try this example. You need to prevent the URL escaping by adding a
<link target="_blank">$row.URL|n$</link> to the token to avoid Splunk adding its own prefix.
<dashboard> <label>TokenTest</label> <row> <panel> <table> <search> <query>| makeresults |eval URL="https://answers.splunk.com/index.html"</query> <earliest>-5s@s</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="drilldown">cell</option> <drilldown> <link target="_blank">$row.URL|n$</link> </drilldown> </table> </panel> </row> </dashboard>