Splunk Search

Injecting FieldValue at the end of external URL from timechart fieldvalue

Contributor

Hi,
I have a dashboard with time-charts... I'm trying to take the "App#" fields values that the time-chart is sourced from and would like to inject the value to the end of the URL below once the bar on the chart is clicked... Is this possible without sideview util?

TestURL:
http:/www.blah.com/app.php?app=<App#>

Panel XML


ErrorApplication#
Error<em>Application</em>#
column
stacked
bottom

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Are you trying to pass to the column names produced by your timechart to an external page? If so, you can do this:

<row>
  <chart>
  ...
  <drilldown>
    <link>http://google.com/search?q=$click.name2$</link>
  </drilldown>
  </chart>
</row>

View solution in original post

SplunkTrust
SplunkTrust

Are you trying to pass to the column names produced by your timechart to an external page? If so, you can do this:

<row>
  <chart>
  ...
  <drilldown>
    <link>http://google.com/search?q=$click.name2$</link>
  </drilldown>
  </chart>
</row>

View solution in original post

SplunkTrust
SplunkTrust

I don't think SimpleXML can do that. I see three options - either make your search results contain a field with the desired value (probably not good for charting, with a table you could hide that field), or make the target more flexible in understanding the passed value. As a last resort, link to a page that does the regex extraction and then redirects to the actual target page.

0 Karma

Contributor

It Works! Nice and easy! Can I change it to use different fields? or can the xml use regex? See, right now the actual click-to is two fields combined for chart illustration purposes - field1 is digits field2 is descriptions. I just need the first field with the digits. A simple \d+ in regex would get me what i need

0 Karma