Splunk Search

Injecting FieldValue at the end of external URL from timechart fieldvalue

subtrakt
Contributor

Hi,
I have a dashboard with time-charts... I'm trying to take the "App#" fields values that the time-chart is sourced from and would like to inject the value to the end of the URL below once the bar on the chart is clicked... Is this possible without sideview util?

TestURL:
http:/www.blah.com/app.php?app=<App#>

Panel XML


Error_Application_#
Error_Application_#
column
stacked
bottom

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Are you trying to pass to the column names produced by your timechart to an external page? If so, you can do this:

<row>
  <chart>
  ...
  <drilldown>
    <link>http://google.com/search?q=$click.name2$</link>
  </drilldown>
  </chart>
</row>

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Are you trying to pass to the column names produced by your timechart to an external page? If so, you can do this:

<row>
  <chart>
  ...
  <drilldown>
    <link>http://google.com/search?q=$click.name2$</link>
  </drilldown>
  </chart>
</row>

martin_mueller
SplunkTrust
SplunkTrust

I don't think SimpleXML can do that. I see three options - either make your search results contain a field with the desired value (probably not good for charting, with a table you could hide that field), or make the target more flexible in understanding the passed value. As a last resort, link to a page that does the regex extraction and then redirects to the actual target page.

0 Karma

subtrakt
Contributor

It Works! Nice and easy! Can I change it to use different fields? or can the xml use regex? See, right now the actual click-to is two fields combined for chart illustration purposes - field1 is digits field2 is descriptions. I just need the first field with the digits. A simple \d+ in regex would get me what i need

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...