Solved: Drilldown to url to display in iframe

jaimerader · ‎08-29-2019

Hello all! I have a dashboard table that has multiple values, one of which being urls. Im trying to pass the value of the url to an iframe on the dashboard and have it display the contents of the url in the iframe when the row is clicked. When a different url is clicked it would then switch to that page. Is this possible??

renjith_nair · ‎08-29-2019

@jaimerader,

It's possible with the tokens.

Here is a run anywhere example

init is set to load local splunk installation. You could set this to default url
Two static urls are set with dummy search. This could be your search result

On drill down set the tokUrl token to clicked row's url value

<dashboard>
  <label>URLs in Iframe</label>
  <init>
    <set token="tokUrl">http://localhost:8000/en-US/app/launcher/home</set>
  </init>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults|eval url="https://answers.splunk.com/index.html http://localhost:8000/en-US/app/search/urls_in_iframe"|makemv url| mvexpand url</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <set token="tokUrl">$row.url$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <html>
      <h3>
        Displayiing content of $tokUrl$
      </h3>
      <body>
        <iframe src="$tokUrl$" width="100%" height="300">
        </iframe>
      </body>
    </html>
  </row>
</dashboard>

Output

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair · ‎08-29-2019

@jaimerader,

It's possible with the tokens.

Here is a run anywhere example

init is set to load local splunk installation. You could set this to default url
Two static urls are set with dummy search. This could be your search result

On drill down set the tokUrl token to clicked row's url value

<dashboard>
  <label>URLs in Iframe</label>
  <init>
    <set token="tokUrl">http://localhost:8000/en-US/app/launcher/home</set>
  </init>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults|eval url="https://answers.splunk.com/index.html http://localhost:8000/en-US/app/search/urls_in_iframe"|makemv url| mvexpand url</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <set token="tokUrl">$row.url$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <html>
      <h3>
        Displayiing content of $tokUrl$
      </h3>
      <body>
        <iframe src="$tokUrl$" width="100%" height="300">
        </iframe>
      </body>
    </html>
  </row>
</dashboard>

Output

---
What goes around comes around. If it helps, hit it with Karma 🙂

jaimerader · ‎08-30-2019

Absolutely perfect! Thank you!!

Drilldown to url to display in iframe

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?