How can I Redirect to Custom URL in Multivalued Column

[JaysonD123]

I have a table that looks like this:

Time	Host	User	Activity
2021-01-01 01:02:01	ABC	Test	CommandLine: C:/Users/Cool/cool.exe File: cool.exe Hash: yr3f7r98jkfd7y38ykry73
2021-01-01 01:02:02	ABC	Test	CommandLine: C:/Users/Lame/lame.exe File: lame.exe Hash: kf39utkuk0ulftu39uk30utk
2021-01-01 01:02:03	ABC	Test	CommandLine: C:/Users/Idk/idk.exe File: idx.exe Hash: 9l09uk8dtyjy4j4098tk48

The query I used to made the table looks something like this:

host=ABC User=Test | rename host AS Host | eval Time=strftime(_time,"%Y-%m-%d %H:%M:%S"),Activity=mvappend("CommandLine: ".CommandLine," ","File: ".File," ","Hash: ".Hash) | table Time Host User Activity | dedup consecutive=true Activity sortby Time

I am trying to use a drilldown to make it so when I click the hash in my Dashboard, it redirects me to a website. The issue I'm have is when I add the link and I click the Hash, instead of just giving me the hash: "9l09uk8dtyjy4j4098tk48", it will give me entire cell "Hash: 9l09uk8dtyjy4j4098tk48" which bugs out my URL.

Expected Output:

https://website.com/9l09uk8dtyjy4j4098tk48

Actual Output:

https://website.com/Hash: 9l09uk8dtyjy4j4098tk48

Another issue is no matter what cell I click they will all try to redirect me to the website:

Example:

https://website.com/CommandLine: C:/Users/Lame/lame.exe

How can I make it so I can only click the hash value to get my expected output?

[nikhil29]

Hi Team,

Actually i am also trying to open the each build url in jenkins but custom url in splunk taking me jenkins website but not in build.

[ITWhisperer]

It is hard to tell without specifics, but I suspect you haven't encoded the information in the drilldown correctly, so Jenkins can't find or doesn't recognise the build information you are passing so defaults to main website.

[ITWhisperer · Accepted solution]

In your drilldown, try eval a new token which has the first part of the clicked value stripped off and use that new token in the link.

[nikhil29]

what shall i use in drill down url , so it can take url value for each table rows ?
Please have a look below code

"eventHandlers": [

                {

                    "type": "drilldown.setToken",

                    "options": {

                        "tokens": [

                            {

                                "token": "build_number",

                                "key": "click.value"

                            }

                        ]

                    }

                },

                {

                    "type": "drilldown.customUrl",

                    "options": {

                        "url": "some jenkins host/view/Puppet%20(develoment)/job/Puppet/job/puppet-development/job/development/\".build_number.\"/",

                        "newTab": true

[nikhil29]

we used to pass in classic dashboard like $row.url|n$

likewise i 'am looking to pass on click link to custom url

[ITWhisperer]

I have no idea about doing it in Studio, but this might work.

"url": "some jenkins host/view/Puppet%20(develoment)/job/Puppet/job/puppet-development/job/development/$click.value|u$/",

 Note the |u to url encode the name token.

[nikhil29]

Tried it's not working, Well Thanks for quick reply

[JaysonD123]

That worked thank you