All Apps and Add-ons

Raw HTML code in sideview HTML module

nhamel
Explorer

Hi all,
I am processing exports of a bug tracking system (HPQC) in our Splunk.
The events contain a field with the "Comments" on the bug, which is delivered in pure HTML code.
For example:

Comments="<html><body>Bug details: <br>This bug occurs every Monday.<br><u>Modules affected: </u><br></body></html>"

I want to link from the bug list in a Table module so that the comments of the selected bug is displayed using the original HTML code, in this example including the br and underline tags.

I can get my comments into a new Table module, but then the HTML tags are treated as normal text.

But I cannot get the comments into a HTML module. I can get all other fields to the HTML, for example the bug ID with $row.fields.HPQC_ID$ or the assignee, but I cannot get the comments field displayed.

search | table HPQC_ID, Ordering, MyComments

< module name="HTML"> 
< param name="html">
< span>Showing details for $row.fields.HPQC_ID$ </span>
< span>$row.fields.MyComments.Value$</span>

Is there any way to render pure HTML from an event to the HTML module?

Thanks
Norbert

0 Karma

sideview
SplunkTrust
SplunkTrust

I think the only problem is that you're using $row.fields.MyComments.Value$. That extra .Value on the end makes it a meaningless key. Replace that with just $row.fields.MyComments$.

The HTML module doesn't do any encoding on embedded $foo$ tokens, so it's quite common to use HTML modules to display actual HTML from the indexed data.

For a wider range of similar use cases, you might check out the ResultsValueSetter docs in Sideview Utils, also the HTML docs to familiarize yourself with the $results[0].someField$ syntax in the HTML module, and even the Table Embedding docs, to see how you can embed that rendered (ie non-escaped) HTML into tablecells in the Table module itself.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...