Solved: Trying to use a dashboard token in an HTML button ...

mjones414 · ‎05-27-2021

I have a dashboard panel configured to set a token called Tok_User to click.value2, and another token called temp_search that sets the the value to user=$Tok_User$

In another panel, I have an HTML button that opens ES incident review using the following URL format:

 <html>
      <style>.btn-primary { margin: 5px 10px 5px 0; }</style>
            <a href="https://mysplunkurl:8000/en_us/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-7d@d&amp;latest=now&amp;form.status_form=*&amp;form.owner_form=*&amp;form.security_domain_form=*&amp;form.srch=$temp_search$&amp;form.selected_urgency=critical&amp;form.selected_urgency=high&amp;form.selected_urgency=medium&amp;form.selected_urgency=low&amp;form.selected_urgency=informational&amp;form.source=A_Src_I_Want&amp;form.source=Another_Src_I_Want&amp; target="_blank" class="btn btn-primary">Review New Activity</a>
      </html>

The sources fill in just fine, but in the search only "user" comes over, not user=<theclickvalue2username>

What am I missing to get this to transition properly?

mjones414 · ‎05-27-2021

Figured it out...

replace "=" in my second token with %3D

View solution in original post

mjones414 · ‎05-27-2021

Figured it out...

replace "=" in my second token with %3D

Trying to use a dashboard token in an HTML button that is a new tab url in incident review

drilldown

panel

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?