Download link in a table?

[jpn627]

Hi all:

Is there an easy way to put a download link in a table? I've got a dashboard with IDS events, and I need to be able to download an associated packet capture. I can construct the link, but when I click on it, the standard drilldown is used.

Something like:

sig, src_ip, src_port, dst_ip, dst_port, user, pcap

Where clicking on the "pcap" field (in a specific row) will retrieve the actual PCAP from where it's stored, via https.

I found this: http://docs.splunk.com/Documentation/Splunk/latest/Developer/EventRendering

But it's fairly complicated, just for a download link. A search command in order to customize the html look and feel of a table cell on the fly would be awesome. (feature request?) 🙂

Thanks!
John

[sideview]

You can do this using the latest Sideview Utils app. Sideview Utils packages a number of UI modules that you can then use in place of many of the core Splunk modules. The end effect is that it augments and extends the Splunk UI.

The Table module in particular, has some features that we group as "custom rendering", and another feature that we group as "custom embeding". It's this latter feature that you can use to do things like put functional HTML links into particular tablecells.

You can read about this feature in the Sideview Utils docs, which are contained in the Sideview Utils app itself.

Download the latest version (2.2.10) from http://sideviewapps.com/apps/sideview-utils, and then once the app is installed into your Splunk instance, navigate to

"Module Documentation > The Table Module > Table - Custom Embedding"

To give you a feeling of what your ultimate config will look like, if your field is called "myLinkField"

<module name="Table">
  <module name="HTML" group="row.fields.myLinkField">
    <param name="html"><![CDATA[
      <a href="$row.fields.myLinkField$">Download</a>
    ]]></param>
  </module>
</module>

and aside from making sure you've read the overview docs and you know how to use Sideview Utils in your views in general, that's it.