Dashboards & Visualizations

How to edit my Simple XML to contain an absolute url in drilldowns?

vectra_tme
Engager

I have done some searching and have not been successful in getting this to work. Most of the examples assume you will be providing the base url and appending the value. In this case, I have a column that contains an absolute URL (https://...) and have added the following to my simple XML, but when I click on it, it prepends the Splunk URL

      <condition field="Host Details">
        <link target="_blank">
          <![CDATA[$click.value2$]]>
        </link>
      </condition>

I have also tried using [https://$click.value2$] but then it prepends https:// so I get https://https://...

I am sure it is something small that I am missing. Any help is greatly appreciated.

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @vectra_tme,
We have a "no encoding" token filter that you might try with the token you are using to represent the absolute URL.

For example:

<link>
$my_token|n$
</link>

See:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Token_filters

Hope this helps! Let me know if not.

0 Karma

somesoni2
Revered Legend

I don't think there is a native method to so (redirect to absolute URL available in field value). There are some workarounds (see the first and last answer) here. Other option is to remove https:// in the field value, so that wen the link module appends its https://, its a valid URL.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...