All Apps and Add-ons

Redirector drilldown based on clicked field

nkorbel
Engager

Is it possible to redirect to different URLs based on the field that was clicked? For example, if I click on a cell for field A, redirect to http://url/A. Clicking on a cell for field B would take me to http://url/B.

I'm looking for something similar to the multiple link support shown here: http://docs.splunk.com/Documentation/Splunk/latest/Viz/Dynamicdrilldownindashboardsandforms#Dynamic_...

Thanks!

1 Solution

sideview
SplunkTrust
SplunkTrust

I'm making the assumption here that you're using a SimpleResultsTable module with drilldown set to "all", so that the users are selecting both a row and a column when they click a cell.

The easiest way in Sideview Utils is to actually use the embedding feature of the Table module and not use Redirector at all. We dont do that funky row+column highlight, but instead we'll use the module-embedding feature of Table to actually make the contents of our two tablecells into actual link tags.

Granted, you could also wire up a Redirector below a SimpleResultsTable, and/or put together a customBehavior to redirect conditionally however you like. If there are more hidden complexities in your use case you may end up going in the CustomBehavior direction anyway.

But anyway, here's what seems to fit the use case you linked to. We embed HTML modules into the tablecells for those two columns in our Table module.

<module name="Table">
  <module name="HTML" group="row.fields.venue">
    <param name="html"><![CDATA[
      <a href="/app/foursquare_vegas/vegas_venue_1?form.venue=$row.fields.venue$">$row.fields.venue$</a>
    ]]></param>
  </module>
  <module name="HTML" group="row.fields.links">
    <param name="html"><![CDATA[
      <a href="http://www.yelp.com/search?find_desc=$row.fields.venue$&find_loc=Las+Vegas,+NV">View in Yelp</a>
    ]]></param>
  </module>
</module>

Technically this example is too simple though, because the venue field doesn't get url-escaped when it's inserted into the href attribute. Simple XML doesn't have this problem because with the Simple XML you can only use the field values in the urls, so presumably it always url-encodes them.

Anyway, here's the more verbose and safer version, that will escape troublesome characters in the venue field so the URL's always work correctly.

<module name="Table">

  <module name="ValueSetter" group="row.fields.venue">
    <param name="urlEncodeKeys">row.fields.venue</param>
    <module name="HTML">
      <param name="html"><![CDATA[
        <a href="/app/foursquare_vegas/vegas_venue_1?form.venue=$row.fields.venue$">see $row.fields.venue$ in Foursquare</a>
      ]]></param>
    </module>
  </module>

  <module name="ValueSetter" group="row.fields.links">
    <param name="urlEncodeKeys">row.fields.venue</param>
    <module name="HTML">
      <param name="html"><![CDATA[
        <a href="http://www.yelp.com/search?find_desc=$row.fields.venue$&find_loc=Las+Vegas,+NV">View in Yelp</a>
      ]]></param>
    </module>
  </module>
</module>

You'll have to use a fields command somewhere, either in a Search or a PostProcess, for there to be an empty "links" column in the Table. You can fill it with whatever you like because it wont matter - the embedded HTML module will overwrite it's contents immediately. I often just do | eval links="OVERRIDDEN BY EMBEDDED MODULES".

As a side note: yes url-encoding is necessary often enough that I really should add a param to do this right to the HTML module. With the new features of Table this will become even more common so I probably will.

And as a general note, this will look really odd to you - it'll look like a drilldown config, until you read the docs about the new Table embedding features. The Table module and its new features are new in Sideview Utils 2.2, and the full docs about the embedding feature specifically are new in Sideview Utils 2.2.9. After you read those docs these examples will be less confusing.

If you are only getting Sideview Utils from Splunkbase, of course you wont have any of this because what's on Splunkbase is the old 1.3.5 version. Get the latest version from the Sideview site (2.2.9) and definitely let me know if you have any problems.

View solution in original post

sideview
SplunkTrust
SplunkTrust

I'm making the assumption here that you're using a SimpleResultsTable module with drilldown set to "all", so that the users are selecting both a row and a column when they click a cell.

The easiest way in Sideview Utils is to actually use the embedding feature of the Table module and not use Redirector at all. We dont do that funky row+column highlight, but instead we'll use the module-embedding feature of Table to actually make the contents of our two tablecells into actual link tags.

Granted, you could also wire up a Redirector below a SimpleResultsTable, and/or put together a customBehavior to redirect conditionally however you like. If there are more hidden complexities in your use case you may end up going in the CustomBehavior direction anyway.

But anyway, here's what seems to fit the use case you linked to. We embed HTML modules into the tablecells for those two columns in our Table module.

<module name="Table">
  <module name="HTML" group="row.fields.venue">
    <param name="html"><![CDATA[
      <a href="/app/foursquare_vegas/vegas_venue_1?form.venue=$row.fields.venue$">$row.fields.venue$</a>
    ]]></param>
  </module>
  <module name="HTML" group="row.fields.links">
    <param name="html"><![CDATA[
      <a href="http://www.yelp.com/search?find_desc=$row.fields.venue$&find_loc=Las+Vegas,+NV">View in Yelp</a>
    ]]></param>
  </module>
</module>

Technically this example is too simple though, because the venue field doesn't get url-escaped when it's inserted into the href attribute. Simple XML doesn't have this problem because with the Simple XML you can only use the field values in the urls, so presumably it always url-encodes them.

Anyway, here's the more verbose and safer version, that will escape troublesome characters in the venue field so the URL's always work correctly.

<module name="Table">

  <module name="ValueSetter" group="row.fields.venue">
    <param name="urlEncodeKeys">row.fields.venue</param>
    <module name="HTML">
      <param name="html"><![CDATA[
        <a href="/app/foursquare_vegas/vegas_venue_1?form.venue=$row.fields.venue$">see $row.fields.venue$ in Foursquare</a>
      ]]></param>
    </module>
  </module>

  <module name="ValueSetter" group="row.fields.links">
    <param name="urlEncodeKeys">row.fields.venue</param>
    <module name="HTML">
      <param name="html"><![CDATA[
        <a href="http://www.yelp.com/search?find_desc=$row.fields.venue$&find_loc=Las+Vegas,+NV">View in Yelp</a>
      ]]></param>
    </module>
  </module>
</module>

You'll have to use a fields command somewhere, either in a Search or a PostProcess, for there to be an empty "links" column in the Table. You can fill it with whatever you like because it wont matter - the embedded HTML module will overwrite it's contents immediately. I often just do | eval links="OVERRIDDEN BY EMBEDDED MODULES".

As a side note: yes url-encoding is necessary often enough that I really should add a param to do this right to the HTML module. With the new features of Table this will become even more common so I probably will.

And as a general note, this will look really odd to you - it'll look like a drilldown config, until you read the docs about the new Table embedding features. The Table module and its new features are new in Sideview Utils 2.2, and the full docs about the embedding feature specifically are new in Sideview Utils 2.2.9. After you read those docs these examples will be less confusing.

If you are only getting Sideview Utils from Splunkbase, of course you wont have any of this because what's on Splunkbase is the old 1.3.5 version. Get the latest version from the Sideview site (2.2.9) and definitely let me know if you have any problems.

nkorbel
Engager

This was exactly what I was looking for. I'm on 2.2.8, which explains why I couldn't find documentation on the Table module.

Thank you for all of your work and the time you spend here!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...