Splunk Search

How to drilldown an external link with part of url in a row

mah
Builder

Hi,

I have a table like this : 

part_of_urlcount
/test11
/test2

2

/test33

 

I want to drilldown with a link which open a new tab by clicking on cell of "part_of_url" column.

I treid this code :

<drilldown>
<condition field="part_of_url">
<link target="_blank">
<![CDATA[https://url.net$click.value$-/results/ ]]>
</link>
</condition>
</drilldown>

But it did not work.

Can you help me ?

Labels (1)
0 Karma
1 Solution

rrovers
Contributor

Your example is not working because of the "/" in your url-field.

As a workaround you could delete the "/" from your field and put in your link to drilldown

<![CDATA[https://answers.splunk.com/$url$ ]]>

Is that an option for you?

But maybe it's not necessary if you need the drilldown you gave in your first example (/test1,/test2,/test3)?

 

 

 

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah,

could you share al the source for that panel?

Probably the problem in in the click or in the field.

please try with:

<![CDATA[https://url.net$row.part_of_url$/results/ ]]>

Ciao.

Giuseppe

0 Karma

mah
Builder

hi @gcusello 

It did not work with the example below :

part_of_url
/index.html

 

I tried this : 

<drilldown>
  <condition field="part_of_url">
    <link target="_blank">
       <![CDATA[https://answers.splunk.com$row.part_of_url$ ]]>
    </link>
  </condition>
</drilldown>

Still not working

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah,

could you share the code of all the panel, not only drilldown?

Ciao.

Giuseppe

0 Karma

mah
Builder

Hi @gcusello 

 

<dashboard>
  <label>Test Dashboard</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval url="/index.html" | table *</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          
            <link target="_blank">
              <![CDATA[https://answers.splunk.com$url$ ]]>
            </link>
          
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

 

 

I have this url generated : https://answers.splunk.com%24url%24/

mah_2-1640008437516.png

 

instead of :

https://answers.splunk.com/index.html

 

 

0 Karma

rrovers
Contributor

Your example is not working because of the "/" in your url-field.

As a workaround you could delete the "/" from your field and put in your link to drilldown

<![CDATA[https://answers.splunk.com/$url$ ]]>

Is that an option for you?

But maybe it's not necessary if you need the drilldown you gave in your first example (/test1,/test2,/test3)?

 

 

 

0 Karma

mah
Builder

It is working by removing "/" from the value and put it in the drilldown before the token.

Thanks !

0 Karma
Get Updates on the Splunk Community!

Harnessing Splunk’s Federated Search for Amazon S3

Managing your data effectively often means balancing performance, costs, and compliance. Splunk’s Federated ...

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...