Splunk Search

How to drilldown an external link with part of url in a row

mah
Builder

Hi,

I have a table like this : 

part_of_urlcount
/test11
/test2

2

/test33

 

I want to drilldown with a link which open a new tab by clicking on cell of "part_of_url" column.

I treid this code :

<drilldown>
<condition field="part_of_url">
<link target="_blank">
<![CDATA[https://url.net$click.value$-/results/ ]]>
</link>
</condition>
</drilldown>

But it did not work.

Can you help me ?

0 Karma
1 Solution

rrovers
Contributor

Your example is not working because of the "/" in your url-field.

As a workaround you could delete the "/" from your field and put in your link to drilldown

<![CDATA[https://answers.splunk.com/$url$ ]]>

Is that an option for you?

But maybe it's not necessary if you need the drilldown you gave in your first example (/test1,/test2,/test3)?

 

 

 

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah,

could you share al the source for that panel?

Probably the problem in in the click or in the field.

please try with:

<![CDATA[https://url.net$row.part_of_url$/results/ ]]>

Ciao.

Giuseppe

0 Karma

mah
Builder

hi @gcusello 

It did not work with the example below :

part_of_url
/index.html

 

I tried this : 

<drilldown>
  <condition field="part_of_url">
    <link target="_blank">
       <![CDATA[https://answers.splunk.com$row.part_of_url$ ]]>
    </link>
  </condition>
</drilldown>

Still not working

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah,

could you share the code of all the panel, not only drilldown?

Ciao.

Giuseppe

0 Karma

mah
Builder

Hi @gcusello 

 

<dashboard>
  <label>Test Dashboard</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval url="/index.html" | table *</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          
            <link target="_blank">
              <![CDATA[https://answers.splunk.com$url$ ]]>
            </link>
          
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

 

 

I have this url generated : https://answers.splunk.com%24url%24/

mah_2-1640008437516.png

 

instead of :

https://answers.splunk.com/index.html

 

 

0 Karma

rrovers
Contributor

Your example is not working because of the "/" in your url-field.

As a workaround you could delete the "/" from your field and put in your link to drilldown

<![CDATA[https://answers.splunk.com/$url$ ]]>

Is that an option for you?

But maybe it's not necessary if you need the drilldown you gave in your first example (/test1,/test2,/test3)?

 

 

 

0 Karma

mah
Builder

It is working by removing "/" from the value and put it in the drilldown before the token.

Thanks !

0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...