Splunk ITSI

Add hyperlink to ITSI Grouped Notable Events

allisonwalther
Path Finder

I would like to add a clickable link inside of the Description of a grouped notable event.

When creating a notable event policy, you have the option of statically naming the description of the grouped events. If you choose static, then put the following:

Description: %description%
Link: <a class="drilldown-link" target="_blank" href="%drilldown_uri%">
<span class="link_title">%drilldown_title%</span>
</a>

It will produce: ![alt text][1]

When the policy is enabled, the Description looks like raw html. No hyperlink.

I believe this is due to a security feature that sanitizes input to protect from html injection. Can someone validate? Or possibly give me a way to work around this?

0 Karma
1 Solution

allisonwalther
Path Finder

Fun fact: if you upgrade to ITSI 3.0, set of grouped events has a table which contains the individual events and a link to their drilldown uri. This is essentially what I was trying to do, except Splunk's solution is much more elegant.

We decided to just go with an upgrade instead of hacking this together. For security purposes and for the sake of saving time, I suggest you do the same.

View solution in original post

0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

This drilldown capability has actually been available since 1.2.0 (but the UI is much prettier now than it used to be). All the drilldown options for the Notable Events Review are documented here: http://docs.splunk.com/Documentation/ITSI/3.1.0/User/CreateCorrelationSearch#Notable_Events

0 Karma

allisonwalther
Path Finder

Fun fact: if you upgrade to ITSI 3.0, set of grouped events has a table which contains the individual events and a link to their drilldown uri. This is essentially what I was trying to do, except Splunk's solution is much more elegant.

We decided to just go with an upgrade instead of hacking this together. For security purposes and for the sake of saving time, I suggest you do the same.

0 Karma
Get Updates on the Splunk Community!

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...

Building a Self-Service and Scalable Observability Practice

Thursday, November 14, 2024  |  11AM PT / 2PM ET Register Now Join us in this session and learn how Splunk ...