Dashboards & Visualizations

How can I Redirect to Custom URL in Multivalued Column

JaysonD123
Explorer

I have a table that looks like this:

Time Host User Activity
2021-01-01 01:02:01 ABC Test

CommandLine: C:/Users/Cool/cool.exe

File: cool.exe

Hash: yr3f7r98jkfd7y38ykry73

2021-01-01 01:02:02 ABC Test

CommandLine: C:/Users/Lame/lame.exe

File: lame.exe

Hash: kf39utkuk0ulftu39uk30utk

2021-01-01 01:02:03 ABC Test

CommandLine: C:/Users/Idk/idk.exe

File: idx.exe

Hash: 9l09uk8dtyjy4j4098tk48

 

The query I used to made the table looks something like this:

host=ABC User=Test | rename host AS Host | eval Time=strftime(_time,"%Y-%m-%d %H:%M:%S"),Activity=mvappend("CommandLine: ".CommandLine," ","File: ".File," ","Hash: ".Hash) | table Time Host User Activity | dedup consecutive=true Activity sortby Time

I am trying to use a drilldown to make it so when I click the hash in my Dashboard, it redirects me to a website. The issue I'm have is when I add the link and I click the Hash, instead of just giving me the hash: "9l09uk8dtyjy4j4098tk48", it will give me entire cell "Hash: 9l09uk8dtyjy4j4098tk48" which bugs out my URL.

 

Expected Output:

https://website.com/9l09uk8dtyjy4j4098tk48

 

Actual Output:

https://website.com/Hash: 9l09uk8dtyjy4j4098tk48

 

Another issue is no matter what cell I click they will all try to redirect me to the website:

 

Example:

https://website.com/CommandLine: C:/Users/Lame/lame.exe

 

How can I make it so I can only click the hash value to get my expected output?

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

In your drilldown, try eval a new token which has the first part of the clicked value stripped off and use that new token in the link.

View solution in original post

nikhil29
Loves-to-Learn Everything

Hi Team,

Actually i am also trying to open the each build url in jenkins but custom url in splunk taking me jenkins website but not in build.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is hard to tell without specifics, but I suspect you haven't encoded the information in the drilldown correctly, so Jenkins can't find or doesn't recognise the build information you are passing so defaults to main website.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In your drilldown, try eval a new token which has the first part of the clicked value stripped off and use that new token in the link.

nikhil29
Loves-to-Learn Everything

what shall i use in drill down url , so it can take url value for each table rows ?
Please have a look below code

"eventHandlers": [
                {
                    "type": "drilldown.setToken",
                    "options": {
                        "tokens": [
                            {
                                "token": "build_number",
                                "key": "click.value"
                            }
                        ]
                    }
                },
                {
                    "type": "drilldown.customUrl",
                    "options": {
                        "url": "some jenkins host/view/Puppet%20(develoment)/job/Puppet/job/puppet-development/job/development/\".build_number.\"/",
                        "newTab": true
Tags (1)
0 Karma

nikhil29
Loves-to-Learn Everything

we used to pass in classic dashboard like $row.url|n$

likewise i 'am looking to pass on click link to custom url

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I have no idea about doing it in Studio, but this might work.

 

"url": "some jenkins host/view/Puppet%20(develoment)/job/Puppet/job/puppet-development/job/development/$click.value|u$/",

 

 Note the |u to url encode the name token.

0 Karma

nikhil29
Loves-to-Learn Everything

Tried it's not working, Well Thanks for quick reply

Tags (1)
0 Karma

JaysonD123
Explorer

That worked thank you 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...