splunk dashboard static pass url to drilldown

[Sukisen1981]

I have a static url , I am using splunk 6.4.x
from a dashboard table i want to open this static url https://www.cvedetails.com/vulnerability-list/vendor_id-93/product_id-19116/version_id-212954/Oracle...
There is a column named vuln which contains this url , all I want to do is to click this column value and open this url in a new window.
NOTE - in the same table i have other rows which should open a different static url

[elliotproebstel]

If you aren't keen on using JavaScript (or don't have access/permission to upload JS files), I can share a workaround I developed for one of my dashboards.

First - you say you want to link to that static URL when a user clicks in that column. I assume you mean that every URL in that column will take the same general format - not you want to link to that same CVE, regardless of which row the user clicks in that column. If that's correct, here's a walkthrough:

STEP ONE: Split the URL
Here's an example with some run-anywhere code, where I split the URL you provided and extract everything after https://www.cvedetails.com/ (based on my earlier assumption that all URLs in this column will take that format)

| makeresults 
| eval url="https://www.cvedetails.com/vulnerability-list/vendor_id-93/product_id-19116/version_id-212954/Oracle-JDK-1.8.html" 
| stats count by url 
| rex field=url "^.*\/\/[^\/]+\/(?<link_value>.+)"

The rex command here creates a second field called link_value.

STEP TWO: Define the fields you want to display in the dashboard
Step one created the field link_value, but we don't want to display that value in the dashboard. Make a list of the other columns in your table and add a <fields> tag to your dashboard on the line following </search> in your dashboard. In my little sample code above, the table now contains three fields: url, count, and link_value. We want to display url and count only, so we'd add this:

<fields>url, count</fields>

STEP THREE: Add the drilldown code
Within the <table> section of your XML, add this drilldown code, which will reassemble the URL and set it as the drilldown destination when users click on any row in the column url:

<drilldown>
  <condition field="url">
    <link target="_blank">
      <![CDATA[https://www.cvedetails.com/$row.link_value|n$]]>
    </link>
  </condition>
</drilldown>

[Sukisen1981]

https://www.cvedetails.com/$row.link_value%7Cn$

Receive error - web page not found , above is the url you will be directed to on clicking the url

[Sukisen1981]

I do think it is a version problem, remember I was on splunk 6.4.x. However, I tried it on 7.x on my local and this code works -



<![CDATA[$click.value2|n$]]>

just passing click.value2$|n$ works on splunk 7.x , maybe it is an issue with splunk 6.4.x

[mayurr98]

hey
you can do this without javascript I have downloaded tutorialdata.zip from this link
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchTutorial/Systemrequirements#Download_th...
and uploaded the same to my local machine!
In that, you have field called referer which is actually URL.
So using that field I have done the same which is your requirement
here is my XML it is very simple

<dashboard>
  <label>Drilldown URL Field Value</label>
  <description>Configure drilldown to redirect users to the URL value of the referer field.</description>
  <row>
    <panel>
      <table>
        <search>
          <query>index=main | head 50 | stats count by referer</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="referer">
            <link target="_blank">$click.value2|n$</link>
          </condition></drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Just change <condition field="vuln"> and change query with <your_query>

let me know if this helps !

[mayurr98]

have you tried this?