Dashboards & Visualizations

How do I enable URL links in output

mpatnode
Path Finder

I have a table in which one column is text which may or may not include a URL. (Think like a twitter feed). Is there an easy way to make the URL's clickable or do I need to format the text somehow?

Tags (2)
1 Solution

araitz
Splunk Employee
Splunk Employee

There is no way that I know of to do this with the current table modules. You would need to super one of the existing table modules or roll your own special module.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Note that this becomes quite easy if you use the Sideview Table module instead of the SimpleResultsTable module, and it doesn't require writing a custom module or any custom code at all.

Say your field was called "url", and say it was a fully formed URL, including the http:// and all that. All you would use is the following XML in your view:

<module name="Table">  
  <module name="HTML" group="row.fields.url">
    <param name="html"><![CDATA[
      <a href="$row.fields.url$">$row.fields.url$</a>
    ]]></param>
  </module>
</module>

There are docs about this feature within Sideview Utils itself. Note that you'll need a relatively recent version of Sideview Utils (currently 2.3) from the Sideview site ( http://sideviewapps.com/apps/sideview-utils ) and not the older version available on Splunkbase.

Once you get the app installed/upgraded, you can find those docs under "Module Documentation > The Table Module > Table - Embedding Examples".

To paraphrase the official docs though, if the Table finds itself with any module immediately downstream that has a group attribute matching "row.fields.someField", and it finds that it actually has a field called "someField" in the results it's rendering, then instead of rendering ordinary text as the contents of those tablecells, it will process and render the given module config. In this case we've given it just a simple HTML module, and as you can see we tell it to render a link in the tablecell instead.

mpatnode
Path Finder

So I used a big hammer to simply copy all the SimpleResultsTable files in $SPLUNKHOME/share/splunk/search_mrsparkle/modules/results to URLResultsTable and then added the following code (stolen from here: http://stackoverflow.com/questions/1112012/replace-url-with-a-link-using-regex-in-python)

import re

....

PAT1 = re.compile(r"(^|[\n ])(([\w]+?://[\w#$%&~.-;:=,?@[]+])(/[\w#$%&~/.-;:=,?@[]+])?)", re.IGNORECASE | re.DOTALL)

PAT2 = re.compile(r"#(^|[\n ])(((www|ftp).[\w#$%&~.-;:=,?@[]+])(/[\w#$%&~/.-;:=,?@[]+])?)", re.IGNORECASE | re.DOTALL)

...

An then right before the return of generateResults()

    # Convert URLs to links
    output = PAT1.sub(r'\1<a href="\2" target="_blank">\2</a>', output)
    output = PAT2.sub(r'\1<a href="http:/\2" target="_blank">\2</a>', output)
    return output

It sounds like this might be easier to do in application.js, but I'm not sure how to filter the entire output stream from there.

0 Karma

araitz
Splunk Employee
Splunk Employee

There is no way that I know of to do this with the current table modules. You would need to super one of the existing table modules or roll your own special module.

View solution in original post

araitz
Splunk Employee
Splunk Employee

Check out the FireEye app on Splunkbase: http://splunkbase.splunk.com/apps/All/4.x/App/app:FireEye. There are some examples of making table rows clickable using application.js.

0 Karma

mpatnode
Path Finder

OK. I'll bite. Have a pointer or example of extending one of the existing table modules? I'm also missing the connection from

in my panel XML file and the registered module list: http://mysplunk:8000/modules. It seems a table is made from multiple modules?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!