Splunk Search

Injecting FieldValue at the end of external URL from timechart fieldvalue

subtrakt
Contributor

Hi,
I have a dashboard with time-charts... I'm trying to take the "App#" fields values that the time-chart is sourced from and would like to inject the value to the end of the URL below once the bar on the chart is clicked... Is this possible without sideview util?

TestURL:
http:/www.blah.com/app.php?app=<App#>

Panel XML


Error_Application_#
Error_Application_#
column
stacked
bottom

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Are you trying to pass to the column names produced by your timechart to an external page? If so, you can do this:

<row>
  <chart>
  ...
  <drilldown>
    <link>http://google.com/search?q=$click.name2$</link>
  </drilldown>
  </chart>
</row>

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Are you trying to pass to the column names produced by your timechart to an external page? If so, you can do this:

<row>
  <chart>
  ...
  <drilldown>
    <link>http://google.com/search?q=$click.name2$</link>
  </drilldown>
  </chart>
</row>

martin_mueller
SplunkTrust
SplunkTrust

I don't think SimpleXML can do that. I see three options - either make your search results contain a field with the desired value (probably not good for charting, with a table you could hide that field), or make the target more flexible in understanding the passed value. As a last resort, link to a page that does the regex extraction and then redirects to the actual target page.

0 Karma

subtrakt
Contributor

It Works! Nice and easy! Can I change it to use different fields? or can the xml use regex? See, right now the actual click-to is two fields combined for chart illustration purposes - field1 is digits field2 is descriptions. I just need the first field with the digits. A simple \d+ in regex would get me what i need

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...