How to record the user who clicked on the row in dashboard?

[Raymond2T]

I have a simple drilldown on my dashboard that users can click on the cell that links to an external website.

How can I get Splunk to log the URL that the users clicked? 

Is it possible to achieve?

Thanks a  lot.

[bowesmana]

Where do you want to log this?

You can use the collect command to log the user, which is known through the $env:user$ token.

When you click the drilldown you can set a new token that causes the search that runs the collect command to run and collect that information to an index you define.

[Raymond2T]

Thanks for the information.

My dashboard has a field called "URL",  AAA.com BBB.com etc.
I only want to know which URL the user clicked.

How can I run collect command to an index?
May I have some references or examples? Thank you.

Finally, I just want to match if the user clicks on the URL, let's say "AAA.com", then the "AAA.com" will disappear on the aforesaid dashboard.

[bowesmana · Accepted solution]

That sort of functionality is quite involved.

The descriptions below are for Simple XML 

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML

https://docs.splunk.com/Documentation/Splunk/9.1.1/Viz/tokens

https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Collect

In your dashboard you will need something like

<drilldown>
  <set token="clicked_url">$row.URL$</set>
  <set token="run_collect"></set>
</drilldown>

You will need a global search that does the collect, e.g. something like this will create a new row with your user/URL and collect that to your index.

This search is dependent on the run_collect token being set, so will only happen when the user clicks the row. It will unset the token at the end, so it can run again.

<search depends="$run_collect$">
  <query>
| makeresults
| eval user=$env:user|s$
| eval URL=$clicked_url|s$
| collect index=your_index
  </query>
  <done>
    <unset token="run_collect">
  </done>
</search>

As to hiding the data on the dashboard, is this to be hidden forever or just in this version of the dashboard?

Much will depend on that.

You don't actually need to collect it to an index, you could write this information to a CSV lookup, which may be a better option if you want to hide this information all the time once clicked.

In that case you could use that as a lookup to filter previous clicked information.

Anyway, this is a fairly complex use case for a dashboard - it's certainly all possible, but this is a bit more involved for a basic dashboard.

This is NOT applicable to dashboard studio - you mention both in your question tags. In principle the approach could be the same, but the technical implementation is not as above.

[Raymond2T]

Thank you so much. it helps me a lot.