I have a static url , I am using splunk 6.4.x
from a dashboard table i want to open this static url https://www.cvedetails.com/vulnerability-list/vendor_id-93/product_id-19116/version_id-212954/Oracle...
There is a column named vuln which contains this url , all I want to do is to click this column value and open this url in a new window.
NOTE - in the same table i have other rows which should open a different static url
First - you say you want to link to that static URL when a user clicks in that column. I assume you mean that every URL in that column will take the same general format - not you want to link to that same CVE, regardless of which row the user clicks in that column. If that's correct, here's a walkthrough:
STEP ONE: Split the URL
Here's an example with some run-anywhere code, where I split the URL you provided and extract everything after
https://www.cvedetails.com/ (based on my earlier assumption that all URLs in this column will take that format)
| makeresults | eval url="https://www.cvedetails.com/vulnerability-list/vendor_id-93/product_id-19116/version_id-212954/Oracle-JDK-1.8.html" | stats count by url | rex field=url "^.*\/\/[^\/]+\/(?<link_value>.+)"
rex command here creates a second field called
STEP TWO: Define the fields you want to display in the dashboard
Step one created the field
link_value, but we don't want to display that value in the dashboard. Make a list of the other columns in your table and add a
<fields> tag to your dashboard on the line following
</search> in your dashboard. In my little sample code above, the table now contains three fields:
link_value. We want to display
count only, so we'd add this:
STEP THREE: Add the drilldown code
<table> section of your XML, add this drilldown code, which will reassemble the URL and set it as the drilldown destination when users click on any row in the column
<drilldown> <condition field="url"> <link target="_blank"> <![CDATA[https://www.cvedetails.com/$row.link_value|n$]]> </link> </condition> </drilldown>
I do think it is a version problem, remember I was on splunk 6.4.x. However, I tried it on 7.x on my local and this code works -
just passing click.value2$|n$ works on splunk 7.x , maybe it is an issue with splunk 6.4.x
tutorialdata.zip from this link
and uploaded the same to my local machine!
In that, you have field called
referer which is actually URL.
So using that field I have done the same which is your requirement
here is my XML it is very simple
<dashboard> <label>Drilldown URL Field Value</label> <description>Configure drilldown to redirect users to the URL value of the referer field.</description> <row> <panel> <table> <search> <query>index=main | head 50 | stats count by referer</query> <earliest>0</earliest> <latest></latest> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> <drilldown> <condition field="referer"> <link target="_blank">$click.value2|n$</link> </condition></drilldown> </table> </panel> </row> </dashboard>
<condition field="vuln"> and change query with
let me know if this helps !