Splunk Search

Injecting FieldValue at the end of external URL from timechart fieldvalue

subtrakt
Contributor

Hi,
I have a dashboard with time-charts... I'm trying to take the "App#" fields values that the time-chart is sourced from and would like to inject the value to the end of the URL below once the bar on the chart is clicked... Is this possible without sideview util?

TestURL:
http:/www.blah.com/app.php?app=<App#>

Panel XML


Error_Application_#
Error_Application_#
column
stacked
bottom

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Are you trying to pass to the column names produced by your timechart to an external page? If so, you can do this:

<row>
  <chart>
  ...
  <drilldown>
    <link>http://google.com/search?q=$click.name2$</link>
  </drilldown>
  </chart>
</row>

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Are you trying to pass to the column names produced by your timechart to an external page? If so, you can do this:

<row>
  <chart>
  ...
  <drilldown>
    <link>http://google.com/search?q=$click.name2$</link>
  </drilldown>
  </chart>
</row>

martin_mueller
SplunkTrust
SplunkTrust

I don't think SimpleXML can do that. I see three options - either make your search results contain a field with the desired value (probably not good for charting, with a table you could hide that field), or make the target more flexible in understanding the passed value. As a last resort, link to a page that does the regex extraction and then redirects to the actual target page.

0 Karma

subtrakt
Contributor

It Works! Nice and easy! Can I change it to use different fields? or can the xml use regex? See, right now the actual click-to is two fields combined for chart illustration purposes - field1 is digits field2 is descriptions. I just need the first field with the digits. A simple \d+ in regex would get me what i need

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...