Dashboards & Visualizations

Redirect to Custom URL in Multivalued Column

JaysonD123
Explorer

I have a table that looks like this:

TimeHostUserActivity
2021-01-01 01:02:01ABCTest

CommandLine: C:/Users/Cool/cool.exe

File: cool.exe

Hash: yr3f7r98jkfd7y38ykry73

2021-01-01 01:02:02ABCTest

CommandLine: C:/Users/Lame/lame.exe

File: lame.exe

Hash: kf39utkuk0ulftu39uk30utk

2021-01-01 01:02:03ABCTest

CommandLine: C:/Users/Idk/idk.exe

File: idx.exe

Hash: 9l09uk8dtyjy4j4098tk48

 

The query I used to made the table looks something like this:

host=ABC User=Test | rename host AS Host | eval Time=strftime(_time,"%Y-%m-%d %H:%M:%S"),Activity=mvappend("CommandLine: ".CommandLine," ","File: ".File," ","Hash: ".Hash) | table Time Host User Activity | dedup consecutive=true Activity sortby Time

I am trying to use a drilldown to make it so when I click the hash in my Dashboard, it redirects me to a website. The issue I'm have is when I add the link and I click the Hash, instead of just giving me the hash: "9l09uk8dtyjy4j4098tk48", it will give me entire cell "Hash: 9l09uk8dtyjy4j4098tk48" which bugs out my URL.

 

Expected Output:

https://website.com/9l09uk8dtyjy4j4098tk48

 

Actual Output:

https://website.com/Hash: 9l09uk8dtyjy4j4098tk48

 

Another issue is no matter what cell I click they will all try to redirect me to the website:

 

Example:

https://website.com/CommandLine: C:/Users/Lame/lame.exe

 

How can I make it so I can only click the hash value to get my expected output?

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

In your drilldown, try eval a new token which has the first part of the clicked value stripped off and use that new token in the link.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

In your drilldown, try eval a new token which has the first part of the clicked value stripped off and use that new token in the link.

View solution in original post

JaysonD123
Explorer

That worked thank you 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!