All Apps and Add-ons

URL encoding of hyperlink using sideview utils

dabarb1
Explorer

So I'm trying to create a hyperlink that is based off a search and postProcess but a little different. So now I'm having problems with 1) having to duplicate the same query text multiple times and 2) having to manually URL encode the query. Consider the example below:


rec=test field1=a | stats count(rec) by rec, field1, field2

field2=b

redirectURL
search,postProcess
rec=test field1=a field2=b <!-- WHAT I WANT THE URL TO CONTAIN -->


<![CDATA[ View Results ]]>




So in the example above, what I'm trying to do is just show the raw records by creating a flashtimeline to a URL encoded query that are associated with the 'search' and the 'postProcess' queries (but not a direct concatenation of the two tokens). So I can no longer pass in the $search$ and $postProcess$ tokens, so the question I have is can I define new tokens to 1) represent the parts of the query I want to reuse and also to pass into the 'urlEncodeKeys' param?

For example, Can I create tokens such that '$tok1$' equates to 'rec=test field1=a' and '$tok2' equates to 'field2=b', and use those tokens within the 'search' params and also to pass those in to the ValueSetter params?

1 Solution

sideview
SplunkTrust
SplunkTrust

It's quite possible I'm missing a nuance of your question. However let me back up and tell the whole story. It's definitely not documented well in Sideview Utils - you have to hunt and peck through my docs pages as well as through my module reference docs to figure it out. You're very close.

1) Very simple case, where we have just a search, no postProcess.
We want to make a properly URL-encoded link to that search, including the timerange.
Here's the simplest config and what I use in my apps:

<module name="ValueSetter">
  <param name="name">rawEventsURL</param>
  <param name="urlEncodeKeys">search</param>
  <param name="value">flashtimeline?q=search $search$&amp;earliest=$search.timeRange.earliest$&amp;latest=$search.timeRange.latest$</param>

  <module name="HTML">
    <param name="html"><![CDATA[
      OLDSCHOOL URL (No SideviewUtils module in the "flashtimeline" view)
      <a href="$rawEventsURL$">test link #1</a>
    ]]></param>
  </module>
</module>

2) A little more complex. Say now we have a postProcess, but we (the app developer) control the postProcess and we can ensure that whenever it's present at all, it'll have a leading pipe character. (Leading pipe's on postProcess searches are not required but they're harmless when present).

<module name="PostProcess">
  <param name="search">| search postprocess #1 (has leading pipe)</param>

  <module name="ValueSetter">
    <param name="name">rawEventsURL</param>
    <param name="urlEncodeKeys">search,postProcess</param>
    <param name="value">flashtimeline?q=search $search$ $postProcess$&amp;earliest=$search.timeRange.earliest$&amp;latest=$search.timeRange.latest$</param>

    <module name="HTML">
      <param name="html"><![CDATA[
        OLDSCHOOL URL (No SideviewUtils module in the "flashtimeline" view)
        <a href="$rawEventsURL$">test link #2</a>
      ]]></param>
    </module>
  </module>

3) We have a search, postProcess, timerange. We want to concatenate the search and postprocess if both are present, but our postProcess string may or may not have a leading pipe:

<module name="PostProcess">
  <param name="search">search postprocess #2 (has NO leading pipe)</param>

  <module name="ValueSetter">
    <param name="name">postProcessWithGuaranteedPipe</param>
    <param name="requiredKeys">postProcess</param>
    <param name="value">| $postProcess$</param>

    <module name="ValueSetter">
      <param name="name">rawEventsURL</param>
      <param name="urlEncodeKeys">search,postProcessWithGuaranteedPipe</param>
      <param name="value">flashtimeline?q=search $search$ $postProcessWithGuaranteedPipe$&amp;earliest=$search.timeRange.earliest$&amp;latest=$search.timeRange.latest$</param>

      <module name="HTML">
        <param name="html"><![CDATA[
          OLDSCHOOL URL (No SideviewUtils module in the "flashtimeline" view)
          <a href="$rawEventsURL$">test link #3</a>
        ]]></param>
      </module>
    </module>
  </module>
</module>

View solution in original post

sideview
SplunkTrust
SplunkTrust

It's quite possible I'm missing a nuance of your question. However let me back up and tell the whole story. It's definitely not documented well in Sideview Utils - you have to hunt and peck through my docs pages as well as through my module reference docs to figure it out. You're very close.

1) Very simple case, where we have just a search, no postProcess.
We want to make a properly URL-encoded link to that search, including the timerange.
Here's the simplest config and what I use in my apps:

<module name="ValueSetter">
  <param name="name">rawEventsURL</param>
  <param name="urlEncodeKeys">search</param>
  <param name="value">flashtimeline?q=search $search$&amp;earliest=$search.timeRange.earliest$&amp;latest=$search.timeRange.latest$</param>

  <module name="HTML">
    <param name="html"><![CDATA[
      OLDSCHOOL URL (No SideviewUtils module in the "flashtimeline" view)
      <a href="$rawEventsURL$">test link #1</a>
    ]]></param>
  </module>
</module>

2) A little more complex. Say now we have a postProcess, but we (the app developer) control the postProcess and we can ensure that whenever it's present at all, it'll have a leading pipe character. (Leading pipe's on postProcess searches are not required but they're harmless when present).

<module name="PostProcess">
  <param name="search">| search postprocess #1 (has leading pipe)</param>

  <module name="ValueSetter">
    <param name="name">rawEventsURL</param>
    <param name="urlEncodeKeys">search,postProcess</param>
    <param name="value">flashtimeline?q=search $search$ $postProcess$&amp;earliest=$search.timeRange.earliest$&amp;latest=$search.timeRange.latest$</param>

    <module name="HTML">
      <param name="html"><![CDATA[
        OLDSCHOOL URL (No SideviewUtils module in the "flashtimeline" view)
        <a href="$rawEventsURL$">test link #2</a>
      ]]></param>
    </module>
  </module>

3) We have a search, postProcess, timerange. We want to concatenate the search and postprocess if both are present, but our postProcess string may or may not have a leading pipe:

<module name="PostProcess">
  <param name="search">search postprocess #2 (has NO leading pipe)</param>

  <module name="ValueSetter">
    <param name="name">postProcessWithGuaranteedPipe</param>
    <param name="requiredKeys">postProcess</param>
    <param name="value">| $postProcess$</param>

    <module name="ValueSetter">
      <param name="name">rawEventsURL</param>
      <param name="urlEncodeKeys">search,postProcessWithGuaranteedPipe</param>
      <param name="value">flashtimeline?q=search $search$ $postProcessWithGuaranteedPipe$&amp;earliest=$search.timeRange.earliest$&amp;latest=$search.timeRange.latest$</param>

      <module name="HTML">
        <param name="html"><![CDATA[
          OLDSCHOOL URL (No SideviewUtils module in the "flashtimeline" view)
          <a href="$rawEventsURL$">test link #3</a>
        ]]></param>
      </module>
    </module>
  </module>
</module>

sideview
SplunkTrust
SplunkTrust

Well remember, if you control the PostProcess searches such that you can ensure that $postProcess$ coming into the ValueSetter will always have a leading pipe, you can use the second example. For example, even if you let the users type the postProcess into a form field, you can set the template param to "| $value$" and that'll tack it on there.

0 Karma

dabarb1
Explorer

So I think what I want is to use the nested 'ValueSetter' like your 3rd example. I guess the point is that I want to build the 'search' and 'postProcess' queries from pre-existing 'ValueSetter' modules, and then also reuse those values for the link to the raw query results as well. I think I know how to use your 3rd example to get me there. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...