Dashboards & Visualizations

Can a drilldown that redirects to an external site be done for multiple columns?

mcm10285
Communicator

I have the code below to drilldown the values of a specific field to an external website (e.g. google and ipvoid). For one field it will popout a new window and search in google. For another field, it will also popout a new window and search in IP void.

The closest I can get is use this.

<module name="SimpleDrilldown">

<param name="links">

<param name="Malware_Name">https://www.google.com/#q=$click.value2$&lt;/param>

<param name="IP">http:www.ipvoid.com/scan/$click.value3$/&lt;/param>

</param>

This results to both popup windows working. First field ("Malware_Name") is properly searched on google. Second field ("IP"), successfully redirects to www.ipvoid.com but it takes the "$click.value3$" literally.

So the question is, is this possible? Is there an argument that will replace "click.value3" and still make both drilldowns work?

Thanks.

Tags (2)
1 Solution

mcm10285
Communicator

Found it, was right under my nose. I used $row.fieldname$ instead of the $click.value3$ (which is I believe is non-existent)...by the way, the popups don't really work (not in code level) unless ctrl-click is done.

Now the next questions is:

1.Is it possible to search for one value in two external sites launched at the same time?

I guess that's for another topic.

View solution in original post

0 Karma

mcm10285
Communicator

Found it, was right under my nose. I used $row.fieldname$ instead of the $click.value3$ (which is I believe is non-existent)...by the way, the popups don't really work (not in code level) unless ctrl-click is done.

Now the next questions is:

1.Is it possible to search for one value in two external sites launched at the same time?

I guess that's for another topic.

0 Karma

sideview
SplunkTrust
SplunkTrust

If $row.fieldname$ is defined then there's a Sideview Table module in there, and if you have that then you should definitely be using the Redirector module instead of the SimpleDrilldown module. Check out the docs on linking in Sideview Utils itself. And make sure you're on the latest Sideview Utils - 3.2.5. Once in a while I run into people who are still using the ancient 1.3.5 version.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...