Splunk Search

Is it possible to pass a URL (Not static) from a search field to create a clickable link in a dashboard?

rromanelli
Explorer

I can hard-code a static URL, but when I pass a value, Splunk adds the host to the URL to direct the link internally.

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi rromanelli,

I also had the same issue and did it by using javascript.
I'm not sure you are Ok with javascript or not, So can you please try below code?

XML

<form script="myjs.js">
  <label>test</label>
  <row>
    <panel>
      <table id="table_link">
        <search>
          <query>index="_internal" | top 5 sourcetype | eval link="http://www.google.com"</query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="*">
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

Javascript :

 require([
    'underscore',
    'jquery',
    'splunkjs/mvc',
    'splunkjs/mvc/tableview',
    'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView) {
    var utils = require("splunkjs/mvc/utils");
    var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
        canRender: function(cell) {
            return _(['link']).contains(cell.field);
        },
        render: function($td, cell) {
            $td.html("<div style='cursor:pointer;'>"+cell.value+"</div>").on("click", function (e){
                console.log(cell.value);
                utils.redirect(cell.value,"_blank");
            });
        }
    });
    //List of table IDs to add icon
    var tableIDs = ["table_link"];
    for (i=0;i<tableIDs.length;i++) {
        var sh = mvc.Components.get(tableIDs[i]);
        if(typeof(sh)!="undefined") {
            sh.getVisualization(function(tableView) {
                // Add custom cell renderer and force re-render
                tableView.table.addCellRenderer(new CustomRangeRenderer());
                tableView.table.render();
            });
        }
    }
});

Let me know if it is useful.

Thanks
Kamlesh

0 Karma

rjthibod
Champion

Can you share your XML? I am not real clear on what exactly you are trying to do.

0 Karma

rromanelli
Explorer
  <table id="link">
    <title>Executions</title>
    <search>
      <query>index=vzwindex Primary.testStatus=$status$ Primary.className=$className$ | eval Name='Primary.methodName' | eval Duration=tostring('Primary.testExecutionDuration', "duration") | eval ReportId=tostring('Primary.reportId') | eval link='Primary.windTunnelReport'  | eval user='Primary.username' | rename Primary.model  as Devices, Primary.device  as "Devices IMEI", Primary.testExecutionStart  as "Start Time", Primary.testExecutionEnd  as "End Time",  Primary.testStatus as Status |  table Name "Start Time" "End Time" Devices  "Devices IMEI" Status link</query>
      <earliest>$TimePicker.earliest$</earliest>
      <latest>$TimePicker.latest$</latest>
    </search>
    <option name="count">5</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="percentagesRow">false</option>
    <option name="rowNumbers">true</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
    <drilldown>
      <link target="_blank">$click.value2$</link>
    </drilldown>
  </table>

I click where there is a link to a unique report in our system. We store the URL in 'Primary.windTunnelReport'.

0 Karma

rjthibod
Champion

Try using the token filter |n. Also, change the use of target="_blank"

So you would edit the drilldown action to be

     <drilldown target="_blank">
       <link>$click.value2|n$</link>
     </drilldown>
0 Karma

rromanelli
Explorer

Thanks, but no. It still prepends :8000/en-US/app/search

0 Karma

niketn
Legend

@rromanelli, which version of Splunk are you using? Whether the URL in link column complete like https://answers.splunk.com/answers/&lt;somenumber> or partial like <somenumber>

If the URL is complete the answer by @rjthibod should work (_blank should work, and you can also restrict click only to link column in the table using code below).

  <drilldown>
    <condition field="link">
      <link target="_blank">$click.value2|n$</link>
    </condition>

In order to test hard-code complete static URL in your directly in you drilldown event handler for link and see whether the page opens or not. If it does not then there is something wrong with the URL. If it launches fine then check the value being populated in the table.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

rromanelli
Explorer

Hi Niketlilay,

This worked! Thank you so much!

Rick

0 Karma
Get Updates on the Splunk Community!

App Building 101 - Build Your First App!

WATCH RECORDING NOW   Tech Talk: App Dev Edition Splunk has tons of out-of-the-box functionality, and you’ve ...

Introducing support for Amazon Data Firehose in Splunk Edge Processor

We’re excited to announce a powerful update to Splunk Data Management with added support for Amazon Data ...

The Observability Round-Up: September 2024

What’s up Splunk Community! Welcome to the latest edition of the Observability Round-Up, a monthly series in ...