How to make table structure in link format?

[aditsss]

Hi Team,

I have used below query:

index="abc*" sourcetype=600000304_gg_abs_ipc2 sourcetype = "600000304_gg_abs_ipc2" " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData" source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" |rex " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData totalOutputRecords=(?<totalOutputRecords>), totalInputRecords=(?<totalInputRecords>),busDt=(?<busDt>),fileName=(?<fileName>),totalClosingBal=(?<totalClosingBal>)"|table _time totalOutputRecords totalInputRecords busDt fileName totalClosingBal

I have displayed the result in tabular format as shown below:

I want this to be in hyperlink format Can anyone please guide:

[gcusello]

Hi @aditsss,

as @richgalloway  said it isn0t clear what you mean with hyperlink.

If you mean that you want to drilldown opening a new search page or dashboard, you have to explore the drilldown feature.

this is a video that explain how to do it: https://www.google.com/search?q=Splunk+dashboard+drilldown&rlz=1C1VDKB_itIT1048IT1048&biw=1920&bih=9...

Ciao.

Giuseppe

[richgalloway]

What do you mean by "hyperlink format"?  What are you linking to?  What do you expect the output to look like?

[aditsss]

@richgalloway 

I want to show in link format or some underline format not plane table

[richgalloway]

That response answers none of my questions.  Please help me help you by provided the requested information.

Underlining is performed by the browser when it finds a URL.

Nothing in the example table lends itself to hyperlinking.  There is no domain name to connect to so any links created would be invalid.  They would look like this

https:///?_time=2023-07-06 08:44:06.168&totalOutputRecords=19011600&totalInputRecords=0&busDt=07/25/2023&fileName=SETTLEMENT_TRANSFORM_MERGE&totalClosingBal=8.51272677817E10

URL encoding will fix some of the problems with this link, but the lack of a destination is a non-starter.

[aditsss]

@richgalloway 

I want to create one hyperlink on clicking of which it will take to raw logs:

current code:

<row>
<panel>
<table>
<search>
<query>index="abc*" sourcetype=600000304_gg_abs_ipc2 sourcetype = "600000304_gg_abs_ipc2" " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData" source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" |rex " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData totalOutputRecords=(?&lt;totalOutputRecords&gt;), totalInputRecords=(?&lt;totalInputRecords&gt;),busDt=(?&lt;busDt&gt;),fileName=(?&lt;fileName&gt;),totalClosingBal=(?&lt;totalClosingBal&gt;)"|table _time totalOutputRecords totalInputRecords busDt fileName totalClosingBal</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>

[richgalloway]

Now I'm starting to understand the use case.

Normally, a dashboard panel presents data in a simplified form and then offers a drilldown into more specific information.  In this case, the table is the simple form and the drilldown would be to the raw data.  The drilldown is the "hyperlink" you seek.  Data in the table will not be underlined so users would have to be educated about the drilldown's availability (perhaps in the panel description).

<row>
<panel>
<table>
<search>
<query>index="abc*" sourcetype=600000304_gg_abs_ipc2 sourcetype = "600000304_gg_abs_ipc2" " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData" source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" |rex " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData totalOutputRecords=(?&lt;totalOutputRecords&gt;), totalInputRecords=(?&lt;totalInputRecords&gt;),busDt=(?&lt;busDt&gt;),fileName=(?&lt;fileName&gt;),totalClosingBal=(?&lt;totalClosingBal&gt;)"|table _time totalOutputRecords totalInputRecords busDt fileName totalClosingBal</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">all</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
  <link target="_blank">search?q=index="abc*" sourcetype=600000304_gg_abs_ipc2 sourcetype = "600000304_gg_abs_ipc2" " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData" source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" _time=$row._time$ |rex " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData totalOutputRecords=(?&lt;totalOutputRecords&gt;), totalInputRecords=(?&lt;totalInputRecords&gt;),busDt=(?&lt;busDt&gt;),fileName=(?&lt;fileName&gt;),totalClosingBal=(?&lt;totalClosingBal&gt;)" | where (totalOuputRecords=$row.totalOuputRecords$ AND totalInputRecords=$row.totalInputRecords$ AND busDT=$row.busDT$ AND fileName=$row.fileName$ AND totalClosingBal=$row.totalClosingBal$)</link>
</drilldown>
</table>
</panel>
</row>

The drilldown link will have to be URL-encoded, but the dashboard editor UI will do that for you.

[ITWhisperer]

You could add css to make the data appear like a link, but which field would you apply that to?

Here is a solution to another question showing this, but you would have to adapt it to suit your needs

Re: Highlight different values table Column in Spl... - Splunk Community

[aditsss]

Hi @richgalloway  @ITWhisperer 

I tried like this below:

<row>
<panel>
<table>
<search>
<query>index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2 sourcetype = "600000304_gg_abs_ipc2" " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData" source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" |rex " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData totalOutputRecords=(?&lt;totalOutputRecords&gt;), totalInputRecords=(?&lt;totalInputRecords&gt;),busDt=(?&lt;busDt&gt;),fileName=(?&lt;fileName&gt;),totalClosingBal=(?&lt;totalClosingBal&gt;)"|table _time totalOutputRecords totalInputRecords busDt fileName totalClosingBal</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<link target="_blank">search?q=index="600000304_d_gridgain_idx*" sourcetype = "600000304_gg_abs_ipc2" " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData" source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" _time=$row._time$ |rex " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData totalOutputRecords=(?&lt;totalOutputRecords&gt;), totalInputRecords=(?&lt;totalInputRecords&gt;),busDt=(?&lt;busDt&gt;),fileName=(?&lt;fileName&gt;),totalClosingBal=(?&lt;totalClosingBal&gt;)" | where (totalOuputRecords=$row.totalOuputRecords$ AND totalInputRecords=$row.totalInputRecords$ AND busDT=$row.busDT$ AND fileName=$row.fileName$ AND totalClosingBal=$row.totalClosingBal$)</link>
</drilldown>
</table>
</panel>
</row>

I am getting output like this:

But clicking on it its not showing drilldown or raw logs

Could you please guide

[richgalloway]

Two things to try:

1) Run the drilldown query in a search window by itself to verify it works.  Make changes as necessary then transfer the resulting query back to the dashboard.

2) Enter the drilldown query using the Dashboard Editor UI rather than by editing the dashboard source directly.  This will ensure the query is properly encoded.

[aditsss]

@ITWhisperer @richgalloway 

Could you please guide here