Dashboards & Visualizations

Newbie: How to create a variable out of multiple fields before passing it to link tag?

jalau9
Explorer

Hi, I'm trying to build HTML links inside a drilldown tag, but that link is quite complex as it uses a few fields in a row. How do I first create the string before putting it into the section? I guess I should use eval but how do I put it into the link tag? This dashboard has multiple tables, but this link only applies to this table.

<row>
<table>
<searchString>index=all | stats count a b c</searchString>
<drilldown target="_blank">
<link field="field1">http:my_url/(complex string)/field1/field2.html</link>
</drilldown>
</table>
</row>

How do I create an eval variable that I pass to link? Sorry if this is so newbie, it's such a simple thing but I don't know how to do it in Splunk.

0 Karma

helenashton
Path Finder

Hi,

You could use an eval to create your link
i.e.

<searchString>index=all | stats count a b c | eval mylink=a+"/"+b+"/"+c+".html"</searchString>

but I think you might run into problems with the slashes getting encoded.

It's just as simple to put your link info in the link tag as it is in the eval.
i.e.

  <drilldown target="_blank">
        <link>http://myurl/$row.a$/$row.b$/$row.c$.html</link>
  </drilldown>

You can also use hidden fields in your URL I believe.
Check the following link for the different options on grabbing clickable values/columns etc.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/Understandbasictableandchartdrilldownactions#D...

Hope this helps.

0 Karma

MuS
Legend

jalau9
Explorer

I don't mean event tokens like click.value, row.. It is a complex string, made up of substr, concatenation and replace functions. Are these functions doable inside the link tag? HTML is not something I've mastered, so please be patient.

0 Karma

helenashton
Path Finder

Ah! I didn't appreciate that from your example. You certainly can.

For a list of the eval functions check out http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonEvalFunctions

My example showed a simple eval, but you can do all sorts.
You mentioned replace...
eval myLink=replace(a,"bob","mary")

You don't need any HTML knowledge here, just explore eval.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...