Splunk Search

How to drilldown an external link with part of url in a row

mah
Builder

Hi,

I have a table like this : 

part_of_urlcount
/test11
/test2

2

/test33

 

I want to drilldown with a link which open a new tab by clicking on cell of "part_of_url" column.

I treid this code :

<drilldown>
<condition field="part_of_url">
<link target="_blank">
<![CDATA[https://url.net$click.value$-/results/ ]]>
</link>
</condition>
</drilldown>

But it did not work.

Can you help me ?

0 Karma
1 Solution

rrovers
Contributor

Your example is not working because of the "/" in your url-field.

As a workaround you could delete the "/" from your field and put in your link to drilldown

<![CDATA[https://answers.splunk.com/$url$ ]]>

Is that an option for you?

But maybe it's not necessary if you need the drilldown you gave in your first example (/test1,/test2,/test3)?

 

 

 

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah,

could you share al the source for that panel?

Probably the problem in in the click or in the field.

please try with:

<![CDATA[https://url.net$row.part_of_url$/results/ ]]>

Ciao.

Giuseppe

0 Karma

mah
Builder

hi @gcusello 

It did not work with the example below :

part_of_url
/index.html

 

I tried this : 

<drilldown>
  <condition field="part_of_url">
    <link target="_blank">
       <![CDATA[https://answers.splunk.com$row.part_of_url$ ]]>
    </link>
  </condition>
</drilldown>

Still not working

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah,

could you share the code of all the panel, not only drilldown?

Ciao.

Giuseppe

0 Karma

mah
Builder

Hi @gcusello 

 

<dashboard>
  <label>Test Dashboard</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval url="/index.html" | table *</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          
            <link target="_blank">
              <![CDATA[https://answers.splunk.com$url$ ]]>
            </link>
          
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

 

 

I have this url generated : https://answers.splunk.com%24url%24/

mah_2-1640008437516.png

 

instead of :

https://answers.splunk.com/index.html

 

 

0 Karma

rrovers
Contributor

Your example is not working because of the "/" in your url-field.

As a workaround you could delete the "/" from your field and put in your link to drilldown

<![CDATA[https://answers.splunk.com/$url$ ]]>

Is that an option for you?

But maybe it's not necessary if you need the drilldown you gave in your first example (/test1,/test2,/test3)?

 

 

 

0 Karma

mah
Builder

It is working by removing "/" from the value and put it in the drilldown before the token.

Thanks !

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...