Splunk Search

How to drilldown an external link with part of url in a row

mah
Builder

Hi,

I have a table like this : 

part_of_urlcount
/test11
/test2

2

/test33

 

I want to drilldown with a link which open a new tab by clicking on cell of "part_of_url" column.

I treid this code :

<drilldown>
<condition field="part_of_url">
<link target="_blank">
<![CDATA[https://url.net$click.value$-/results/ ]]>
</link>
</condition>
</drilldown>

But it did not work.

Can you help me ?

0 Karma
1 Solution

rrovers
Contributor

Your example is not working because of the "/" in your url-field.

As a workaround you could delete the "/" from your field and put in your link to drilldown

<![CDATA[https://answers.splunk.com/$url$ ]]>

Is that an option for you?

But maybe it's not necessary if you need the drilldown you gave in your first example (/test1,/test2,/test3)?

 

 

 

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah,

could you share al the source for that panel?

Probably the problem in in the click or in the field.

please try with:

<![CDATA[https://url.net$row.part_of_url$/results/ ]]>

Ciao.

Giuseppe

0 Karma

mah
Builder

hi @gcusello 

It did not work with the example below :

part_of_url
/index.html

 

I tried this : 

<drilldown>
  <condition field="part_of_url">
    <link target="_blank">
       <![CDATA[https://answers.splunk.com$row.part_of_url$ ]]>
    </link>
  </condition>
</drilldown>

Still not working

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah,

could you share the code of all the panel, not only drilldown?

Ciao.

Giuseppe

0 Karma

mah
Builder

Hi @gcusello 

 

<dashboard>
  <label>Test Dashboard</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval url="/index.html" | table *</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          
            <link target="_blank">
              <![CDATA[https://answers.splunk.com$url$ ]]>
            </link>
          
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

 

 

I have this url generated : https://answers.splunk.com%24url%24/

mah_2-1640008437516.png

 

instead of :

https://answers.splunk.com/index.html

 

 

0 Karma

rrovers
Contributor

Your example is not working because of the "/" in your url-field.

As a workaround you could delete the "/" from your field and put in your link to drilldown

<![CDATA[https://answers.splunk.com/$url$ ]]>

Is that an option for you?

But maybe it's not necessary if you need the drilldown you gave in your first example (/test1,/test2,/test3)?

 

 

 

0 Karma

mah
Builder

It is working by removing "/" from the value and put it in the drilldown before the token.

Thanks !

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...