Dashboards & Visualizations

Trying to use a dashboard token in an HTML button that is a new tab url in incident review

mjones414
Contributor

I have a dashboard panel configured to set a token called Tok_User  to click.value2, and another token called temp_search that sets the the value to user=$Tok_User$

 

In another panel, I have an HTML button that opens ES incident review using the following URL format:

 <html>
      <style>.btn-primary { margin: 5px 10px 5px 0; }</style>
            <a href="https://mysplunkurl:8000/en_us/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-7d@d&amp;latest=now&amp;form.status_form=*&amp;form.owner_form=*&amp;form.security_domain_form=*&amp;form.srch=$temp_search$&amp;form.selected_urgency=critical&amp;form.selected_urgency=high&amp;form.selected_urgency=medium&amp;form.selected_urgency=low&amp;form.selected_urgency=informational&amp;form.source=A_Src_I_Want&amp;form.source=Another_Src_I_Want&amp; target="_blank" class="btn btn-primary">Review New Activity</a>
      </html>

 

The sources fill in just fine, but in the search only "user" comes over, not user=<theclickvalue2username>

 

What am I missing to get this to transition properly?

Labels (2)
Tags (2)
0 Karma
1 Solution

mjones414
Contributor

Figured it out...

replace "=" in my second token with %3D

View solution in original post

0 Karma

mjones414
Contributor

Figured it out...

replace "=" in my second token with %3D

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!