Splunk IT Service Intelligence

Add hyperlink to ITSI Grouped Notable Events

allisonwalther
Path Finder

I would like to add a clickable link inside of the Description of a grouped notable event.

When creating a notable event policy, you have the option of statically naming the description of the grouped events. If you choose static, then put the following:

Description: %description%
Link: <a class="drilldown-link" target="_blank" href="%drilldown_uri%">
<span class="link_title">%drilldown_title%</span>
</a>

It will produce: ![alt text][1]

When the policy is enabled, the Description looks like raw html. No hyperlink.

I believe this is due to a security feature that sanitizes input to protect from html injection. Can someone validate? Or possibly give me a way to work around this?

0 Karma
1 Solution

allisonwalther
Path Finder

Fun fact: if you upgrade to ITSI 3.0, set of grouped events has a table which contains the individual events and a link to their drilldown uri. This is essentially what I was trying to do, except Splunk's solution is much more elegant.

We decided to just go with an upgrade instead of hacking this together. For security purposes and for the sake of saving time, I suggest you do the same.

View solution in original post

0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

This drilldown capability has actually been available since 1.2.0 (but the UI is much prettier now than it used to be). All the drilldown options for the Notable Events Review are documented here: http://docs.splunk.com/Documentation/ITSI/3.1.0/User/CreateCorrelationSearch#Notable_Events

0 Karma

allisonwalther
Path Finder

Fun fact: if you upgrade to ITSI 3.0, set of grouped events has a table which contains the individual events and a link to their drilldown uri. This is essentially what I was trying to do, except Splunk's solution is much more elegant.

We decided to just go with an upgrade instead of hacking this together. For security purposes and for the sake of saving time, I suggest you do the same.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...