Splunk table and drill down in Dashboard Studio

[SplunkerNoob]

I have a Splunk table that has 3 rows and a count for each row. How do I make each value in table go to a different URL.  This is what I have but every row I click goes to that link. I want each table to go to a different link.

    "type": "splunk.table",

    "dataSources": {

        "primary": "ds_5ds4f5"

    },

    "title": "Device Inventory",

    "eventHandlers": [

        {

            "type": "drilldown.customUrl",

            "options": {

                "url": "https://device.com",

                "newTab": true

            }

        }

    ],

[SplunkerNoob]

I think it is working but unfortunately I get:

The URL you clicked cannot open as it is invalid and might contain malicious code. Change the URL to a relative or absolute URL, such as /app/search/datasets or https://www.splunk.com.

[KendallW]

Hi @SplunkerNoob 

Assuming these are external URLs (not other dashboards/searches within Splunk), you can add the trusted domains to the drilldownUrlWhitelist setting in the web.conf file. 

---

@SplunkerNoob wrote:

I think it is working but unfortunately I get:

The URL you clicked cannot open as it is invalid and might contain malicious code. Change the URL to a relative or absolute URL, such as /app/search/datasets or https://www.splunk.com.

---

[KendallW]

Hi @SplunkerNoob, first create a field in your search which contains the URLs, e.g. 

...
| eval target_url=case(
    device_type=="type1", "https://device1.com",
    device_type=="type2", "https://device2.com",
    device_type=="type3", "https://device3.com",
    1=1, "https://default.com"
)

Then in your dashboard:

<drilldown>
    <link target="_blank">{{row.target_url}}</link>
</drilldown>

[KendallW]

Or with JSON:

{
    "type": "splunk.table",
    "dataSources": {
        "primary": "ds_5ds4f5"
    },
    "title": "Device Inventory",
    "eventHandlers": [
        {
            "type": "drilldown.customUrl",
            "options": {
                "url": "{{row.target_url}}",
                "newTab": true
            }
        }
    ]
}