Splunk IT Service Intelligence

Add hyperlink to ITSI Grouped Notable Events

allisonwalther
Path Finder

I would like to add a clickable link inside of the Description of a grouped notable event.

When creating a notable event policy, you have the option of statically naming the description of the grouped events. If you choose static, then put the following:

Description: %description%
Link: <a class="drilldown-link" target="_blank" href="%drilldown_uri%">
<span class="link_title">%drilldown_title%</span>
</a>

It will produce: ![alt text][1]

When the policy is enabled, the Description looks like raw html. No hyperlink.

I believe this is due to a security feature that sanitizes input to protect from html injection. Can someone validate? Or possibly give me a way to work around this?

0 Karma
1 Solution

allisonwalther
Path Finder

Fun fact: if you upgrade to ITSI 3.0, set of grouped events has a table which contains the individual events and a link to their drilldown uri. This is essentially what I was trying to do, except Splunk's solution is much more elegant.

We decided to just go with an upgrade instead of hacking this together. For security purposes and for the sake of saving time, I suggest you do the same.

View solution in original post

0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

This drilldown capability has actually been available since 1.2.0 (but the UI is much prettier now than it used to be). All the drilldown options for the Notable Events Review are documented here: http://docs.splunk.com/Documentation/ITSI/3.1.0/User/CreateCorrelationSearch#Notable_Events

0 Karma

allisonwalther
Path Finder

Fun fact: if you upgrade to ITSI 3.0, set of grouped events has a table which contains the individual events and a link to their drilldown uri. This is essentially what I was trying to do, except Splunk's solution is much more elegant.

We decided to just go with an upgrade instead of hacking this together. For security purposes and for the sake of saving time, I suggest you do the same.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...