Splunk Dev

make fields clickable

ringbbg
Engager

Hi,

I created a search that extracts a field called PARSER with the syntax below and put the results on table format. The other fields are already static field extractions on our global system.

index=nm drqs EXCHANGE sourcetype = ntwkserv TCPReceiver | rex field=_raw "(?\D\FIFW\s\w+\s\w+\s.+\DGO\D\D)" max_match=0 | table _time, PARSER, MACHINE,ISSUE,iP,pORT,Ticket | sort 0 -_time

The output is as I expected, however, PARSER field is actually a URL that I want to open on a new tab/window that should output like this: bbg://screens/NMS%20SVCB%20PSE.

Instead, the PARSER field on the table is not clickable. I need to right click on it and select OPen in new tab or window to have it opened. Is there a way for me to have this url open/run with just 1 click?

Thanks

Tags (1)
0 Karma
1 Solution

niketn
Legend

@ringbbg, you can create a <drilldown> event for the table with URL field to open in new window using <link target=_blank>

Examples for URL drilldown from table are present in Splunk 6.x Dashboard Examples App in Splunkbase. Kindly refer the same.

<drilldown>
    <!-- Following code creates drilldown only when PARSER column values are clicked -->
    <condition field="PARSER">
         <link target="_blank">$row.PARSER$</link>
    </condition>
</drilldown>

$row.PARSER$ is the default table token used to access the value of the PARSER field for the row which is clicked.

You might have to use CDATA and/or token filters for $row.PARSER$ to ensure that target URL is formed as expected: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@ringbbg, you can create a <drilldown> event for the table with URL field to open in new window using <link target=_blank>

Examples for URL drilldown from table are present in Splunk 6.x Dashboard Examples App in Splunkbase. Kindly refer the same.

<drilldown>
    <!-- Following code creates drilldown only when PARSER column values are clicked -->
    <condition field="PARSER">
         <link target="_blank">$row.PARSER$</link>
    </condition>
</drilldown>

$row.PARSER$ is the default table token used to access the value of the PARSER field for the row which is clicked.

You might have to use CDATA and/or token filters for $row.PARSER$ to ensure that target URL is formed as expected: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...