Splunk Dev

make fields clickable

ringbbg
Engager

Hi,

I created a search that extracts a field called PARSER with the syntax below and put the results on table format. The other fields are already static field extractions on our global system.

index=nm drqs EXCHANGE sourcetype = ntwkserv TCPReceiver | rex field=_raw "(?\D\FIFW\s\w+\s\w+\s.+\DGO\D\D)" max_match=0 | table _time, PARSER, MACHINE,ISSUE,iP,pORT,Ticket | sort 0 -_time

The output is as I expected, however, PARSER field is actually a URL that I want to open on a new tab/window that should output like this: bbg://screens/NMS%20SVCB%20PSE.

Instead, the PARSER field on the table is not clickable. I need to right click on it and select OPen in new tab or window to have it opened. Is there a way for me to have this url open/run with just 1 click?

Thanks

Tags (1)
0 Karma
1 Solution

niketn
Legend

@ringbbg, you can create a <drilldown> event for the table with URL field to open in new window using <link target=_blank>

Examples for URL drilldown from table are present in Splunk 6.x Dashboard Examples App in Splunkbase. Kindly refer the same.

<drilldown>
    <!-- Following code creates drilldown only when PARSER column values are clicked -->
    <condition field="PARSER">
         <link target="_blank">$row.PARSER$</link>
    </condition>
</drilldown>

$row.PARSER$ is the default table token used to access the value of the PARSER field for the row which is clicked.

You might have to use CDATA and/or token filters for $row.PARSER$ to ensure that target URL is formed as expected: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@ringbbg, you can create a <drilldown> event for the table with URL field to open in new window using <link target=_blank>

Examples for URL drilldown from table are present in Splunk 6.x Dashboard Examples App in Splunkbase. Kindly refer the same.

<drilldown>
    <!-- Following code creates drilldown only when PARSER column values are clicked -->
    <condition field="PARSER">
         <link target="_blank">$row.PARSER$</link>
    </condition>
</drilldown>

$row.PARSER$ is the default table token used to access the value of the PARSER field for the row which is clicked.

You might have to use CDATA and/or token filters for $row.PARSER$ to ensure that target URL is formed as expected: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...