Splunk Search
Highlighted

How to click on table cell to go to a URL referenced in event field (not in row data)?

New Member

I can't seem to figure out how to configure my XML so that when I click on a table cell, I go to a URL referenced in the cell's event's url_id field. The url_id field is in the same event as which I grab the table cell's value, but it is not actually in the table. Then, after setting the token as url_token, I set a link in drilldown with <link>https://specificurl.com/$url_token$</link>. However, when I test it out in my dashboard, clicking on a table cell brings me to https://specificurl.com/%24result.url_id%24 instead.

Any suggestions for what to do to fix this? Thank you.

<panel>
  <table>
    <search>
      <query> [search query here] </query>
      <earliest>@w0</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>
      <finalized>
        <set token="url_token">$result.url_id$</set>
      </finalized>
    </search>
    <option name="count">50</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="percentagesRow">false</option>
    <option name="refresh.display">progressbar</option>
    <option name="rowNumbers">false</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
    <drilldown>
        <link>https://specificurl.com/$url_token$</link>
    </drilldown>
  </table>
</panel>
0 Karma
Highlighted

Re: How to click on table cell to go to a URL referenced in event field (not in row data)?

Champion

Hi

Check this, here url will not display in the table but onclick of Host it is used in the drilldown.

<dashboard>
  <label>drilldown_url</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval url="http://www.google.com",Host="Google" 
| append 
    [| makeresults 
    | eval url="http://www.yahoo.com",Host="Yahoo"] 
| append 
    [| makeresults 
    | eval url="http://www.facebook.com",Host="Facebook"]|table url,_time,Host</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
       <fields>_time,Host</fields>
        <drilldown>
         <eval token="url">replace($row.url$, "http://", ""</eval>
           <link target="_blank">
             <![CDATA[ http://$url$ ]]>
           </link>
           </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Highlighted

Re: How to click on table cell to go to a URL referenced in event field (not in row data)?

Legend

@c_yeo you are trying to merge two different features together i.e. Search Event Handler and Drilldown.

Using $result.<yourFieldName>$ in <progress> or <done> Search Event Handler you get only one or first value of your field. Which is not what you want. Moreover the <finalized> search event handler was deprecated from Splunk 6.5 onward so it would not work with latest version anyways. This is the reason why you are getting %24 in your drilldown URL is because is it the URL encoded character for $ which implies your token from search event handler is not getting resolved.

What you need to do is to use built-in drilldown token called $row.<yourFieldName>$ to access the field value from the row in the table which is clicked.

Please try out following drilldown code

   <drilldown>
       <link target="_blank">https://specificurl.com/$row.url_id$</link>
   </drilldown>

Following is a run anywhere example for you to try and confirm:

<dashboard>
  <label>Link to URL using token from table</label>
  <row>
   <panel>
     <table>
       <search>
         <query>| makeresults
         | eval urlid="splunk,splunkbase,splunk answers"
         | makemv urlid delim=","
         | mvexpand urlid</query>
         <earliest>@w0</earliest>
         <latest>now</latest>
         <sampleRatio>1</sampleRatio>
       </search>
       <option name="count">50</option>
       <option name="dataOverlayMode">none</option>
       <option name="drilldown">cell</option>
       <option name="percentagesRow">false</option>
       <option name="refresh.display">progressbar</option>
       <option name="rowNumbers">false</option>
       <option name="totalsRow">false</option>
       <option name="wrap">true</option>
       <drilldown>
           <link target="_blank">https://www.google.com/search?&amp;q=$row.urlid$</link>
       </drilldown>
     </table>
   </panel>
  </row>
</dashboard>

PS: Also check out Splunk Dashboard Examples app to check out several drilldown examples including link to URL.




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: How to click on table cell to go to a URL referenced in event field (not in row data)?

New Member

@niketnilay thank you -- I've tried out your suggestion using $row.urlid$ in the drilldown. However, now when I click on the cell, I am bounced to the link https://specificurl.com/$row.urlid$. I think it's important for me to note that I do not reference the field urlid in my search query at all, I am handling other fields. Do you have any further suggestions for the tokenization to succeed?

0 Karma