Add hyperlink to ITSI Grouped Notable Events

[allisonwalther]

I would like to add a clickable link inside of the Description of a grouped notable event.

When creating a notable event policy, you have the option of statically naming the description of the grouped events. If you choose static, then put the following:

Description: %description%
Link: <a class="drilldown-link" target="_blank" href="%drilldown_uri%">
<span class="link_title">%drilldown_title%</span>
</a>

It will produce: ![alt text][1]

When the policy is enabled, the Description looks like raw html. No hyperlink.

I believe this is due to a security feature that sanitizes input to protect from html injection. Can someone validate? Or possibly give me a way to work around this?

[esnyder_splunk]

This drilldown capability has actually been available since 1.2.0 (but the UI is much prettier now than it used to be). All the drilldown options for the Notable Events Review are documented here: http://docs.splunk.com/Documentation/ITSI/3.1.0/User/CreateCorrelationSearch#Notable_Events

[allisonwalther · Accepted solution]

Fun fact: if you upgrade to ITSI 3.0, set of grouped events has a table which contains the individual events and a link to their drilldown uri. This is essentially what I was trying to do, except Splunk's solution is much more elegant.

We decided to just go with an upgrade instead of hacking this together. For security purposes and for the sake of saving time, I suggest you do the same.