make fields clickable

[ringbbg]

Hi,

I created a search that extracts a field called PARSER with the syntax below and put the results on table format. The other fields are already static field extractions on our global system.

index=nm drqs EXCHANGE sourcetype = ntwkserv TCPReceiver | rex field=_raw "(?\D\FIFW\s\w+\s\w+\s.+\DGO\D\D)" max_match=0 | table _time, PARSER, MACHINE,ISSUE,iP,pORT,Ticket | sort 0 -_time

The output is as I expected, however, PARSER field is actually a URL that I want to open on a new tab/window that should output like this: bbg://screens/NMS%20SVCB%20PSE.

Instead, the PARSER field on the table is not clickable. I need to right click on it and select OPen in new tab or window to have it opened. Is there a way for me to have this url open/run with just 1 click?

Thanks

[niketn · Accepted solution]

@ringbbg, you can create a <drilldown> event for the table with URL field to open in new window using <link target=_blank>

Examples for URL drilldown from table are present in Splunk 6.x Dashboard Examples App in Splunkbase. Kindly refer the same.

<drilldown>
    <!-- Following code creates drilldown only when PARSER column values are clicked -->
    <condition field="PARSER">
         <link target="_blank">$row.PARSER$</link>
    </condition>
</drilldown>

$row.PARSER$ is the default table token used to access the value of the PARSER field for the row which is clicked.

You might have to use CDATA and/or token filters for $row.PARSER$ to ensure that target URL is formed as expected: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters.