All Apps and Add-ons

Raw HTML code in sideview HTML module

nhamel
Explorer

Hi all,
I am processing exports of a bug tracking system (HPQC) in our Splunk.
The events contain a field with the "Comments" on the bug, which is delivered in pure HTML code.
For example:

Comments="<html><body>Bug details: <br>This bug occurs every Monday.<br><u>Modules affected: </u><br></body></html>"

I want to link from the bug list in a Table module so that the comments of the selected bug is displayed using the original HTML code, in this example including the br and underline tags.

I can get my comments into a new Table module, but then the HTML tags are treated as normal text.

But I cannot get the comments into a HTML module. I can get all other fields to the HTML, for example the bug ID with $row.fields.HPQC_ID$ or the assignee, but I cannot get the comments field displayed.

search | table HPQC_ID, Ordering, MyComments

< module name="HTML"> 
< param name="html">
< span>Showing details for $row.fields.HPQC_ID$ </span>
< span>$row.fields.MyComments.Value$</span>

Is there any way to render pure HTML from an event to the HTML module?

Thanks
Norbert

0 Karma

sideview
SplunkTrust
SplunkTrust

I think the only problem is that you're using $row.fields.MyComments.Value$. That extra .Value on the end makes it a meaningless key. Replace that with just $row.fields.MyComments$.

The HTML module doesn't do any encoding on embedded $foo$ tokens, so it's quite common to use HTML modules to display actual HTML from the indexed data.

For a wider range of similar use cases, you might check out the ResultsValueSetter docs in Sideview Utils, also the HTML docs to familiarize yourself with the $results[0].someField$ syntax in the HTML module, and even the Table Embedding docs, to see how you can embed that rendered (ie non-escaped) HTML into tablecells in the Table module itself.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...