All Apps and Add-ons

splunk dashboard static pass url to drilldown


I have a static url , I am using splunk 6.4.x
from a dashboard table i want to open this static url
There is a column named vuln which contains this url , all I want to do is to click this column value and open this url in a new window.
NOTE - in the same table i have other rows which should open a different static url

0 Karma


If you aren't keen on using JavaScript (or don't have access/permission to upload JS files), I can share a workaround I developed for one of my dashboards.

First - you say you want to link to that static URL when a user clicks in that column. I assume you mean that every URL in that column will take the same general format - not you want to link to that same CVE, regardless of which row the user clicks in that column. If that's correct, here's a walkthrough:

STEP ONE: Split the URL
Here's an example with some run-anywhere code, where I split the URL you provided and extract everything after (based on my earlier assumption that all URLs in this column will take that format)

| makeresults 
| eval url="" 
| stats count by url 
| rex field=url "^.*\/\/[^\/]+\/(?<link_value>.+)"

The rex command here creates a second field called link_value.

STEP TWO: Define the fields you want to display in the dashboard
Step one created the field link_value, but we don't want to display that value in the dashboard. Make a list of the other columns in your table and add a <fields> tag to your dashboard on the line following </search> in your dashboard. In my little sample code above, the table now contains three fields: url, count, and link_value. We want to display url and count only, so we'd add this:

<fields>url, count</fields>

STEP THREE: Add the drilldown code
Within the <table> section of your XML, add this drilldown code, which will reassemble the URL and set it as the drilldown destination when users click on any row in the column url:

  <condition field="url">
    <link target="_blank">
0 Karma


Receive error - web page not found , above is the url you will be directed to on clicking the url

0 Karma


I do think it is a version problem, remember I was on splunk 6.4.x. However, I tried it on 7.x on my local and this code works -


just passing click.value2$|n$ works on splunk 7.x , maybe it is an issue with splunk 6.4.x

0 Karma

Super Champion

you can do this without javascript I have downloaded from this link
and uploaded the same to my local machine!
In that, you have field called referer which is actually URL.
So using that field I have done the same which is your requirement
here is my XML it is very simple

  <label>Drilldown URL Field Value</label>
  <description>Configure drilldown to redirect users to the URL value of the referer field.</description>
          <query>index=main | head 50 | stats count by referer</query>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
          <condition field="referer">
            <link target="_blank">$click.value2|n$</link>

Just change <condition field="vuln"> and change query with <your_query>

let me know if this helps !

0 Karma

Super Champion

have you tried this?

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...