Dashboards & Visualizations

Dashboard Outside URL off Title

ccsfdave
Builder

Greetings,

I have a table that results in:

Title URL
Blah http://blah.com

So what I would like to do is create a Dashboard that just shows the title and when it is clicked on, it goes to the corresponding URL.

Thanks.

Dave

Tags (3)
0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

Assuming you don't want to write and maintain a bunch of custom Javascript, I think you have to use the Advanced XML and the Sideview Utils app. Possibly there's a way with just the core advanced XML but I don't know of a way to not display the URL in the table then.

Download and install the latest Sideview Utils app (from here http://sideviewapps.com/apps/sideview-utils ). Read the first few intro pages of the app itself, and then read the documentation around the Table module.

Here's a quick standalone example view.

<view autoCancelInterval="90" isVisible="False" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <label>hiding URL field, but using it in drilldown clicks</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="Search" layoutPanel="panel_row1_col1">
    <param name="search"><![CDATA[
      your search here
    ]]></param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">URL</param>
        <module name="Redirector">
          <param name="url">$row.fields.URL$</param>
        </module>
      </module>
    </module>
  </module>
</view>

View solution in original post

ccsfdave
Builder

The XML was slightly different but pretty darn close to what you gave me above.

I had to adjust it ever so slightly. I added this to the module name tag which made the search run and gave the panel a title:

autoRun="True" group="US-CERT RSS"

In the <![CDATA[your search here]]> tag, I didn't need the CDATA, just the search unquoted.

Other than that, thanks for having me scratch the surface of sideview - I will definitely read more over the next few weeks. It sounds SO powerful!

0 Karma

sideview
SplunkTrust
SplunkTrust

Assuming you don't want to write and maintain a bunch of custom Javascript, I think you have to use the Advanced XML and the Sideview Utils app. Possibly there's a way with just the core advanced XML but I don't know of a way to not display the URL in the table then.

Download and install the latest Sideview Utils app (from here http://sideviewapps.com/apps/sideview-utils ). Read the first few intro pages of the app itself, and then read the documentation around the Table module.

Here's a quick standalone example view.

<view autoCancelInterval="90" isVisible="False" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <label>hiding URL field, but using it in drilldown clicks</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="Search" layoutPanel="panel_row1_col1">
    <param name="search"><![CDATA[
      your search here
    ]]></param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">URL</param>
        <module name="Redirector">
          <param name="url">$row.fields.URL$</param>
        </module>
      </module>
    </module>
  </module>
</view>

ccsfdave
Builder

The XML was slightly different but pretty darn close to what you gave me above.

I had to adjust it ever so slightly. I added this to the module name tag which made the search run and gave the panel a title:

autoRun="True" group="US-CERT RSS"

In the <![CDATA[your search here]]> tag, I didn't need the CDATA, just the search unquoted.

Other than that, thanks for having me scratch the surface of sideview - I will definitely read more over the next few weeks. It sounds SO powerful!

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...