Dashboards & Visualizations

Cloud - Dashboard Studio - What is the correct way to Link to custom URL table tokens

mikemenzies
Engager

I have a table with a few columns in it. One of the columns is 'url'. I would like to construct a relative search URL that opens in a new tab.

 

        {
            "type": "drilldown.customUrl",
            "options": {
                "url": "/en-US/app/search/search?q=search%20index%3D\"$index$\"%20url%3D\"$click.value$\"",
                "newTab": true
            }
        }

 

 

Token resolution works. $index$ is replaced as it should be (this is an existing token on my dashboard). But I can't seem to access anything in table. $click.value$ is clearly wrong. I've tried a bunch of other styles from the docs too.

$row.url.value$

$row.url$

$row.value.2$

$url.value$

The problem I think is that I'm looking at documentation for older Splunk versions and/or documentation for the classic xml dashboard.

What's the correct way to do this? Also, is there up-to-date documentation available for this?

 

 

Labels (2)

Champ
Engager

Hi, 

I was having the same issue at first. Looks like you will just need to make your url one whole line for this to have the functionality you want.

{
            "type": "drilldown.customUrl",
            "options": {
                "url": "/en-US/app/search/search?q=search%20index%3D\$index$\%20url%3D\$click.value$\",
                "newTab": true
            }
        }

If it isn't working then you may need to add the whole url path to the url input:

{
            "type": "drilldown.customUrl",
            "options": {
                "url": "https://my-splunkpath.com/en-US/app/search/search?q=search%20index%3D\$index$\%20url%3D\$click.value$\",
                "newTab": true
            }
        }

If the click value isn't working you may want to look at your tokens above. I added another token event handler to set the token before the url handle. It does have a bit of a delay on my end though. Hopefully this adds a bit of direction for further use. 

"eventHandlers": [
 {
   "type": "drilldown.setToken",
   "options": {
   "tokens": [
	{
	  "token": "selection_tok",
	  "key": "click.value"
	}
	]
    }
},{
            "type": "drilldown.customUrl",
            "options": {
                "url": "/en-US/app/search/search?q=search%20index%3D\$index$\%20url%3D\$selection_tok$\",
                "newTab": true
            }
        }

 

Hope that helps / fills in some of the gaps for new people looking into adding dynamic search to their dashboard. 

MMahlberg
Explorer

Correct Answer here.

This now also works in Splunk Enterprise 9.0.

 

Unfortunately there is no way yet to add both via the GUI and you have to go into the Code Editor to add the other Part.

0 Karma

Lucas_Stern
Engager

Mike, the docs for the dashboard studio is the following:
https://docs.splunk.com/Documentation/SplunkCloud/8.2.2112/DashStudio/tokens

But, I also didn't manage to make the link work.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...