Re: How can I parse the URL from cell in Drilldown...

splunktrain9 · ‎12-18-2020

I have multiple cells that contain information like:
URL
Name

When I click on the cell, I want to open a tab to URL, and ignore "name".

For example, in this table when I click on the cell, I want to navigate to someurl, assuming someurl is an actual webpage link.

| makeresults 
| eval A="someurl",B="someurl",C="someurl",A_name="somename",B_name="somename",C_name="somename"
| eval As = mvappend(A,A_name)
| eval Bs = mvappend(B,B_name)
| eval Cs = mvappend(C,C_name)
| table As Bs Cs

to4kawa · ‎12-19-2020

sample:

<dashboard>
  <label>drilldown_multi</label>
  <init>
    <unset token="url"></unset>
    <unset token="url2"></unset>
  </init>
  <row>
    <panel>
      <table id="tableMulti">
        <search>
          <query>| makeresults 
| eval A="someurl1",B="someurl2",C="someurl3",A_name="somename1",B_name="somename2",C_name="somename3"
| eval As = mvappend(A,A_name)
| eval Bs = mvappend(B,B_name)
| eval Cs = mvappend(C,C_name)
| table As Bs Cs
| nomv As | nomv Bs |nomv Cs</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <eval token="url">$click.value2$</eval>
          <eval token="url2">replace($url$,".*$","")</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row><panel><html><p>$url$</p><p>$url2$</p></html></panel></row>
</dashboard>

How can I parse the URL from cell in Drilldown?

drilldown

panel

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

Shape the Future of Splunk: Join the Product Research Lab!

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

Are you a member of the Splunk Community?