All Apps and Add-ons

splunk dashboard static pass url to drilldown


I have a static url , I am using splunk 6.4.x
from a dashboard table i want to open this static url
There is a column named vuln which contains this url , all I want to do is to click this column value and open this url in a new window.
NOTE - in the same table i have other rows which should open a different static url

0 Karma


If you aren't keen on using JavaScript (or don't have access/permission to upload JS files), I can share a workaround I developed for one of my dashboards.

First - you say you want to link to that static URL when a user clicks in that column. I assume you mean that every URL in that column will take the same general format - not you want to link to that same CVE, regardless of which row the user clicks in that column. If that's correct, here's a walkthrough:

STEP ONE: Split the URL
Here's an example with some run-anywhere code, where I split the URL you provided and extract everything after (based on my earlier assumption that all URLs in this column will take that format)

| makeresults 
| eval url="" 
| stats count by url 
| rex field=url "^.*\/\/[^\/]+\/(?<link_value>.+)"

The rex command here creates a second field called link_value.

STEP TWO: Define the fields you want to display in the dashboard
Step one created the field link_value, but we don't want to display that value in the dashboard. Make a list of the other columns in your table and add a <fields> tag to your dashboard on the line following </search> in your dashboard. In my little sample code above, the table now contains three fields: url, count, and link_value. We want to display url and count only, so we'd add this:

<fields>url, count</fields>

STEP THREE: Add the drilldown code
Within the <table> section of your XML, add this drilldown code, which will reassemble the URL and set it as the drilldown destination when users click on any row in the column url:

  <condition field="url">
    <link target="_blank">
0 Karma


Receive error - web page not found , above is the url you will be directed to on clicking the url

0 Karma


I do think it is a version problem, remember I was on splunk 6.4.x. However, I tried it on 7.x on my local and this code works -


just passing click.value2$|n$ works on splunk 7.x , maybe it is an issue with splunk 6.4.x

0 Karma

Super Champion

you can do this without javascript I have downloaded from this link
and uploaded the same to my local machine!
In that, you have field called referer which is actually URL.
So using that field I have done the same which is your requirement
here is my XML it is very simple

  <label>Drilldown URL Field Value</label>
  <description>Configure drilldown to redirect users to the URL value of the referer field.</description>
          <query>index=main | head 50 | stats count by referer</query>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
          <condition field="referer">
            <link target="_blank">$click.value2|n$</link>

Just change <condition field="vuln"> and change query with <your_query>

let me know if this helps !

0 Karma

Super Champion

have you tried this?

0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out &gt;&gt; Kudos to all the ...