Splunk Enterprise Security
Highlighted

How do I drilldown to a unique URL using a table row's unique token?

Path Finder

Situation:

  • I have a panel. The panel creates a token for me from a field I extract from the search. In the same panel I create a URL that enables me to "drilldown".



    Open Tickets




    search...
    | table "ticketnum", "Creation Date", "otherfield", "otherfield"

    $field3.earliest$
    $field3.latest$


    <set token="ticketnum">$result.ticket_num$



    5
    none
    row
    true

           <eval>replace($row.url$, "http://", ""</eval>
           <link target="_blank">
             <![CDATA[ https://other.tool/$ticket_num$ ]]>
           </link>
         </drilldown>
    
      </table>
    </panel>
    

  • My table appears to work nicely where each row represents unique open tickets.

  • Problem:

    • All rows, upon clicking, "drilldown" only to the first row's "ticket_num". Which I think makes sense.

    Question:

    • Can you pleas share if its possible with ES simple XML and without any other add-on to modify the panel so that, upon clicking a row, I "drilldown" to the respective row's unique "ticket_num"?

0 Karma
Highlighted

Re: How do I drilldown to a unique URL using a table row's unique token?

Communicator

You'll likely need some form of this:

<drilldown>
  <link target="_blank">/app/some_app/some_dashboard?token=$click.value$&amp;token2=$row.fieldname$</link>
</drilldown>

https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/tokens

View solution in original post

Highlighted

Re: How do I drilldown to a unique URL using a table row's unique token?

Path Finder

@memarshall63 - thanks so much for your time to write this comment. This led me down the right path! The below appears to create a unique URL per row that is clicked. Thanks so much.

            <link target="_blank">
              <![CDATA[ https://other.tool/$click.value$ ]]>
            </link>
0 Karma
Highlighted

Re: How do I drilldown to a unique URL using a table row's unique token?

Communicator

No problem. I believe $click.value$ will give you the field that is clicked. However, you may want to use a specific field regardless of where on the row the click occurs. When that occurs I think $row.$ is the choice for that behavior. At any rate... good luck.

0 Karma