Splunk Search

How to drilldown an external link with part of url in a row

mah
Builder

Hi,

I have a table like this : 

part_of_urlcount
/test11
/test2

2

/test33

 

I want to drilldown with a link which open a new tab by clicking on cell of "part_of_url" column.

I treid this code :

<drilldown>
<condition field="part_of_url">
<link target="_blank">
<![CDATA[https://url.net$click.value$-/results/ ]]>
</link>
</condition>
</drilldown>

But it did not work.

Can you help me ?

0 Karma
1 Solution

rrovers
Contributor

Your example is not working because of the "/" in your url-field.

As a workaround you could delete the "/" from your field and put in your link to drilldown

<![CDATA[https://answers.splunk.com/$url$ ]]>

Is that an option for you?

But maybe it's not necessary if you need the drilldown you gave in your first example (/test1,/test2,/test3)?

 

 

 

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah,

could you share al the source for that panel?

Probably the problem in in the click or in the field.

please try with:

<![CDATA[https://url.net$row.part_of_url$/results/ ]]>

Ciao.

Giuseppe

0 Karma

mah
Builder

hi @gcusello 

It did not work with the example below :

part_of_url
/index.html

 

I tried this : 

<drilldown>
  <condition field="part_of_url">
    <link target="_blank">
       <![CDATA[https://answers.splunk.com$row.part_of_url$ ]]>
    </link>
  </condition>
</drilldown>

Still not working

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah,

could you share the code of all the panel, not only drilldown?

Ciao.

Giuseppe

0 Karma

mah
Builder

Hi @gcusello 

 

<dashboard>
  <label>Test Dashboard</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval url="/index.html" | table *</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          
            <link target="_blank">
              <![CDATA[https://answers.splunk.com$url$ ]]>
            </link>
          
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

 

 

I have this url generated : https://answers.splunk.com%24url%24/

mah_2-1640008437516.png

 

instead of :

https://answers.splunk.com/index.html

 

 

0 Karma

rrovers
Contributor

Your example is not working because of the "/" in your url-field.

As a workaround you could delete the "/" from your field and put in your link to drilldown

<![CDATA[https://answers.splunk.com/$url$ ]]>

Is that an option for you?

But maybe it's not necessary if you need the drilldown you gave in your first example (/test1,/test2,/test3)?

 

 

 

0 Karma

mah
Builder

It is working by removing "/" from the value and put it in the drilldown before the token.

Thanks !

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...