Solved: Drilldown to url to display in iframe

jaimerader · ‎08-29-2019

Hello all! I have a dashboard table that has multiple values, one of which being urls. Im trying to pass the value of the url to an iframe on the dashboard and have it display the contents of the url in the iframe when the row is clicked. When a different url is clicked it would then switch to that page. Is this possible??

renjith_nair · ‎08-29-2019

@jaimerader,

It's possible with the tokens.

Here is a run anywhere example

init is set to load local splunk installation. You could set this to default url
Two static urls are set with dummy search. This could be your search result

On drill down set the tokUrl token to clicked row's url value

<dashboard>
  <label>URLs in Iframe</label>
  <init>
    <set token="tokUrl">http://localhost:8000/en-US/app/launcher/home</set>
  </init>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults|eval url="https://answers.splunk.com/index.html http://localhost:8000/en-US/app/search/urls_in_iframe"|makemv url| mvexpand url</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <set token="tokUrl">$row.url$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <html>
      <h3>
        Displayiing content of $tokUrl$
      </h3>
      <body>
        <iframe src="$tokUrl$" width="100%" height="300">
        </iframe>
      </body>
    </html>
  </row>
</dashboard>

Output

Happy Splunking!

View solution in original post

renjith_nair · ‎08-29-2019

@jaimerader,

It's possible with the tokens.

Here is a run anywhere example

init is set to load local splunk installation. You could set this to default url
Two static urls are set with dummy search. This could be your search result

On drill down set the tokUrl token to clicked row's url value

<dashboard>
  <label>URLs in Iframe</label>
  <init>
    <set token="tokUrl">http://localhost:8000/en-US/app/launcher/home</set>
  </init>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults|eval url="https://answers.splunk.com/index.html http://localhost:8000/en-US/app/search/urls_in_iframe"|makemv url| mvexpand url</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <set token="tokUrl">$row.url$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <html>
      <h3>
        Displayiing content of $tokUrl$
      </h3>
      <body>
        <iframe src="$tokUrl$" width="100%" height="300">
        </iframe>
      </body>
    </html>
  </row>
</dashboard>

Output

Happy Splunking!

jaimerader · ‎08-30-2019

Absolutely perfect! Thank you!!

Drilldown to url to display in iframe

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

Observability Highlights | January 2023 Newsletter

Security Highlights | January 2023 Newsletter