Splunk Dev

make fields clickable

ringbbg
Engager

Hi,

I created a search that extracts a field called PARSER with the syntax below and put the results on table format. The other fields are already static field extractions on our global system.

index=nm drqs EXCHANGE sourcetype = ntwkserv TCPReceiver | rex field=_raw "(?\D\FIFW\s\w+\s\w+\s.+\DGO\D\D)" max_match=0 | table _time, PARSER, MACHINE,ISSUE,iP,pORT,Ticket | sort 0 -_time

The output is as I expected, however, PARSER field is actually a URL that I want to open on a new tab/window that should output like this: bbg://screens/NMS%20SVCB%20PSE.

Instead, the PARSER field on the table is not clickable. I need to right click on it and select OPen in new tab or window to have it opened. Is there a way for me to have this url open/run with just 1 click?

Thanks

Tags (1)
0 Karma
1 Solution

niketn
Legend

@ringbbg, you can create a <drilldown> event for the table with URL field to open in new window using <link target=_blank>

Examples for URL drilldown from table are present in Splunk 6.x Dashboard Examples App in Splunkbase. Kindly refer the same.

<drilldown>
    <!-- Following code creates drilldown only when PARSER column values are clicked -->
    <condition field="PARSER">
         <link target="_blank">$row.PARSER$</link>
    </condition>
</drilldown>

$row.PARSER$ is the default table token used to access the value of the PARSER field for the row which is clicked.

You might have to use CDATA and/or token filters for $row.PARSER$ to ensure that target URL is formed as expected: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@ringbbg, you can create a <drilldown> event for the table with URL field to open in new window using <link target=_blank>

Examples for URL drilldown from table are present in Splunk 6.x Dashboard Examples App in Splunkbase. Kindly refer the same.

<drilldown>
    <!-- Following code creates drilldown only when PARSER column values are clicked -->
    <condition field="PARSER">
         <link target="_blank">$row.PARSER$</link>
    </condition>
</drilldown>

$row.PARSER$ is the default table token used to access the value of the PARSER field for the row which is clicked.

You might have to use CDATA and/or token filters for $row.PARSER$ to ensure that target URL is formed as expected: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...