Dashboards & Visualizations

How can I Redirect to Custom URL in Multivalued Column

JaysonD123
Explorer

I have a table that looks like this:

Time Host User Activity
2021-01-01 01:02:01 ABC Test

CommandLine: C:/Users/Cool/cool.exe

File: cool.exe

Hash: yr3f7r98jkfd7y38ykry73

2021-01-01 01:02:02 ABC Test

CommandLine: C:/Users/Lame/lame.exe

File: lame.exe

Hash: kf39utkuk0ulftu39uk30utk

2021-01-01 01:02:03 ABC Test

CommandLine: C:/Users/Idk/idk.exe

File: idx.exe

Hash: 9l09uk8dtyjy4j4098tk48

 

The query I used to made the table looks something like this:

host=ABC User=Test | rename host AS Host | eval Time=strftime(_time,"%Y-%m-%d %H:%M:%S"),Activity=mvappend("CommandLine: ".CommandLine," ","File: ".File," ","Hash: ".Hash) | table Time Host User Activity | dedup consecutive=true Activity sortby Time

I am trying to use a drilldown to make it so when I click the hash in my Dashboard, it redirects me to a website. The issue I'm have is when I add the link and I click the Hash, instead of just giving me the hash: "9l09uk8dtyjy4j4098tk48", it will give me entire cell "Hash: 9l09uk8dtyjy4j4098tk48" which bugs out my URL.

 

Expected Output:

https://website.com/9l09uk8dtyjy4j4098tk48

 

Actual Output:

https://website.com/Hash: 9l09uk8dtyjy4j4098tk48

 

Another issue is no matter what cell I click they will all try to redirect me to the website:

 

Example:

https://website.com/CommandLine: C:/Users/Lame/lame.exe

 

How can I make it so I can only click the hash value to get my expected output?

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

In your drilldown, try eval a new token which has the first part of the clicked value stripped off and use that new token in the link.

View solution in original post

nikhil29
Loves-to-Learn Everything

Hi Team,

Actually i am also trying to open the each build url in jenkins but custom url in splunk taking me jenkins website but not in build.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is hard to tell without specifics, but I suspect you haven't encoded the information in the drilldown correctly, so Jenkins can't find or doesn't recognise the build information you are passing so defaults to main website.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In your drilldown, try eval a new token which has the first part of the clicked value stripped off and use that new token in the link.

nikhil29
Loves-to-Learn Everything

what shall i use in drill down url , so it can take url value for each table rows ?
Please have a look below code

"eventHandlers": [
                {
                    "type": "drilldown.setToken",
                    "options": {
                        "tokens": [
                            {
                                "token": "build_number",
                                "key": "click.value"
                            }
                        ]
                    }
                },
                {
                    "type": "drilldown.customUrl",
                    "options": {
                        "url": "some jenkins host/view/Puppet%20(develoment)/job/Puppet/job/puppet-development/job/development/\".build_number.\"/",
                        "newTab": true
Tags (1)
0 Karma

nikhil29
Loves-to-Learn Everything

we used to pass in classic dashboard like $row.url|n$

likewise i 'am looking to pass on click link to custom url

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I have no idea about doing it in Studio, but this might work.

 

"url": "some jenkins host/view/Puppet%20(develoment)/job/Puppet/job/puppet-development/job/development/$click.value|u$/",

 

 Note the |u to url encode the name token.

0 Karma

nikhil29
Loves-to-Learn Everything

Tried it's not working, Well Thanks for quick reply

Tags (1)
0 Karma

JaysonD123
Explorer

That worked thank you 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...