Splunk Search

Download link in a table?

jpn627
New Member

Hi all:

Is there an easy way to put a download link in a table? I've got a dashboard with IDS events, and I need to be able to download an associated packet capture. I can construct the link, but when I click on it, the standard drilldown is used.

Something like:

sig, src_ip, src_port, dst_ip, dst_port, user, pcap

Where clicking on the "pcap" field (in a specific row) will retrieve the actual PCAP from where it's stored, via https.

I found this: http://docs.splunk.com/Documentation/Splunk/latest/Developer/EventRendering

But it's fairly complicated, just for a download link. A search command in order to customize the html look and feel of a table cell on the fly would be awesome. (feature request?) 🙂

Thanks!
John

0 Karma

sideview
SplunkTrust
SplunkTrust

You can do this using the latest Sideview Utils app. Sideview Utils packages a number of UI modules that you can then use in place of many of the core Splunk modules. The end effect is that it augments and extends the Splunk UI.

The Table module in particular, has some features that we group as "custom rendering", and another feature that we group as "custom embeding". It's this latter feature that you can use to do things like put functional HTML links into particular tablecells.

You can read about this feature in the Sideview Utils docs, which are contained in the Sideview Utils app itself.

Download the latest version (2.2.10) from http://sideviewapps.com/apps/sideview-utils, and then once the app is installed into your Splunk instance, navigate to

"Module Documentation > The Table Module > Table - Custom Embedding"

To give you a feeling of what your ultimate config will look like, if your field is called "myLinkField"

<module name="Table">
  <module name="HTML" group="row.fields.myLinkField">
    <param name="html"><![CDATA[
      <a href="$row.fields.myLinkField$">Download</a>
    ]]></param>
  </module>
</module>

and aside from making sure you've read the overview docs and you know how to use Sideview Utils in your views in general, that's it.

Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...