Raw HTML code in sideview HTML module

nhamel · ‎06-27-2013

Hi all,
I am processing exports of a bug tracking system (HPQC) in our Splunk.
The events contain a field with the "Comments" on the bug, which is delivered in pure HTML code.
For example:

Comments="<html><body>Bug details: This bug occurs every Monday. Modules affected: </body></html>"

I want to link from the bug list in a Table module so that the comments of the selected bug is displayed using the original HTML code, in this example including the br and underline tags.

I can get my comments into a new Table module, but then the HTML tags are treated as normal text.

But I cannot get the comments into a HTML module. I can get all other fields to the HTML, for example the bug ID with $row.fields.HPQC_ID$ or the assignee, but I cannot get the comments field displayed.

search | table HPQC_ID, Ordering, MyComments

< module name="HTML"> 
< param name="html">
< span>Showing details for $row.fields.HPQC_ID$ </span>
< span>$row.fields.MyComments.Value$</span>

Is there any way to render pure HTML from an event to the HTML module?

Thanks
Norbert

sideview · ‎06-27-2013

I think the only problem is that you're using $row.fields.MyComments.Value$. That extra .Value on the end makes it a meaningless key. Replace that with just $row.fields.MyComments$.

The HTML module doesn't do any encoding on embedded $foo$ tokens, so it's quite common to use HTML modules to display actual HTML from the indexed data.

For a wider range of similar use cases, you might check out the ResultsValueSetter docs in Sideview Utils, also the HTML docs to familiarize yourself with the $results[0].someField$ syntax in the HTML module, and even the Table Embedding docs, to see how you can embed that rendered (ie non-escaped) HTML into tablecells in the Table module itself.

Raw HTML code in sideview HTML module

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Observability Simplified: Combining User Experience, Application Performance & ...

Event Series May & June: From Network Visibility to Service Intelligence

Global Splunk User Group Events: May + June 2026

Join the Conversation

Raw HTML code in sideview HTML module

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Observability Simplified: Combining User Experience, Application Performance & ...

Event Series May & June: From Network Visibility to Service Intelligence

Global Splunk User Group Events: May + June 2026