Splunk Search

Is it possible to pass a URL (Not static) from a search field to create a clickable link in a dashboard?

rromanelli
Explorer

I can hard-code a static URL, but when I pass a value, Splunk adds the host to the URL to direct the link internally.

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi rromanelli,

I also had the same issue and did it by using javascript.
I'm not sure you are Ok with javascript or not, So can you please try below code?

XML

<form script="myjs.js">
  <label>test</label>
  <row>
    <panel>
      <table id="table_link">
        <search>
          <query>index="_internal" | top 5 sourcetype | eval link="http://www.google.com"</query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="*">
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

Javascript :

 require([
    'underscore',
    'jquery',
    'splunkjs/mvc',
    'splunkjs/mvc/tableview',
    'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView) {
    var utils = require("splunkjs/mvc/utils");
    var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
        canRender: function(cell) {
            return _(['link']).contains(cell.field);
        },
        render: function($td, cell) {
            $td.html("<div style='cursor:pointer;'>"+cell.value+"</div>").on("click", function (e){
                console.log(cell.value);
                utils.redirect(cell.value,"_blank");
            });
        }
    });
    //List of table IDs to add icon
    var tableIDs = ["table_link"];
    for (i=0;i<tableIDs.length;i++) {
        var sh = mvc.Components.get(tableIDs[i]);
        if(typeof(sh)!="undefined") {
            sh.getVisualization(function(tableView) {
                // Add custom cell renderer and force re-render
                tableView.table.addCellRenderer(new CustomRangeRenderer());
                tableView.table.render();
            });
        }
    }
});

Let me know if it is useful.

Thanks
Kamlesh

0 Karma

rjthibod
Champion

Can you share your XML? I am not real clear on what exactly you are trying to do.

0 Karma

rromanelli
Explorer
  <table id="link">
    <title>Executions</title>
    <search>
      <query>index=vzwindex Primary.testStatus=$status$ Primary.className=$className$ | eval Name='Primary.methodName' | eval Duration=tostring('Primary.testExecutionDuration', "duration") | eval ReportId=tostring('Primary.reportId') | eval link='Primary.windTunnelReport'  | eval user='Primary.username' | rename Primary.model  as Devices, Primary.device  as "Devices IMEI", Primary.testExecutionStart  as "Start Time", Primary.testExecutionEnd  as "End Time",  Primary.testStatus as Status |  table Name "Start Time" "End Time" Devices  "Devices IMEI" Status link</query>
      <earliest>$TimePicker.earliest$</earliest>
      <latest>$TimePicker.latest$</latest>
    </search>
    <option name="count">5</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="percentagesRow">false</option>
    <option name="rowNumbers">true</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
    <drilldown>
      <link target="_blank">$click.value2$</link>
    </drilldown>
  </table>

I click where there is a link to a unique report in our system. We store the URL in 'Primary.windTunnelReport'.

0 Karma

rjthibod
Champion

Try using the token filter |n. Also, change the use of target="_blank"

So you would edit the drilldown action to be

     <drilldown target="_blank">
       <link>$click.value2|n$</link>
     </drilldown>
0 Karma

rromanelli
Explorer

Thanks, but no. It still prepends :8000/en-US/app/search

0 Karma

niketn
Legend

@rromanelli, which version of Splunk are you using? Whether the URL in link column complete like https://answers.splunk.com/answers/&lt;somenumber> or partial like <somenumber>

If the URL is complete the answer by @rjthibod should work (_blank should work, and you can also restrict click only to link column in the table using code below).

  <drilldown>
    <condition field="link">
      <link target="_blank">$click.value2|n$</link>
    </condition>

In order to test hard-code complete static URL in your directly in you drilldown event handler for link and see whether the page opens or not. If it does not then there is something wrong with the URL. If it launches fine then check the value being populated in the table.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

rromanelli
Explorer

Hi Niketlilay,

This worked! Thank you so much!

Rick

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...