Splunk IT Service Intelligence

Add hyperlink to ITSI Grouped Notable Events

allisonwalther
Path Finder

I would like to add a clickable link inside of the Description of a grouped notable event.

When creating a notable event policy, you have the option of statically naming the description of the grouped events. If you choose static, then put the following:

Description: %description%
Link: <a class="drilldown-link" target="_blank" href="%drilldown_uri%">
<span class="link_title">%drilldown_title%</span>
</a>

It will produce: ![alt text][1]

When the policy is enabled, the Description looks like raw html. No hyperlink.

I believe this is due to a security feature that sanitizes input to protect from html injection. Can someone validate? Or possibly give me a way to work around this?

0 Karma
1 Solution

allisonwalther
Path Finder

Fun fact: if you upgrade to ITSI 3.0, set of grouped events has a table which contains the individual events and a link to their drilldown uri. This is essentially what I was trying to do, except Splunk's solution is much more elegant.

We decided to just go with an upgrade instead of hacking this together. For security purposes and for the sake of saving time, I suggest you do the same.

View solution in original post

0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

This drilldown capability has actually been available since 1.2.0 (but the UI is much prettier now than it used to be). All the drilldown options for the Notable Events Review are documented here: http://docs.splunk.com/Documentation/ITSI/3.1.0/User/CreateCorrelationSearch#Notable_Events

0 Karma

allisonwalther
Path Finder

Fun fact: if you upgrade to ITSI 3.0, set of grouped events has a table which contains the individual events and a link to their drilldown uri. This is essentially what I was trying to do, except Splunk's solution is much more elegant.

We decided to just go with an upgrade instead of hacking this together. For security purposes and for the sake of saving time, I suggest you do the same.

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...