How to add an external link reference into a Splunk /services/message using the Splunk REST API?

[alauri]

Hi guys,

I'm using the REST API "/services/messages" to send a message to Splunk and it works fine.
Now, I need to insert an external link into that message.

For example, I'd like to replicate something like

<a href="mailto:example@example.com">Example</a>

into a message I'm sending to "/services/messages" REST APIs of Splunk.

Is it possible to do that?

Thanks in advance.

[frobinson_splun · Accepted solution]

Hi @alauri:
Here is a link to the current documentation on sending a message via services/messages:

http://docs.splunk.com/Documentation/Splunk/6.2.3/RESTREF/RESTsystem#messages

It looks like you should be able to pass a String value for the message, but I am not sure about placing an external link with markup and having the link work. Let me look into this with our engineers. I'll report back!

Thanks! Please feel free to post further feedback and/or questions here.

[alauri]

Hi @frobinson_splunk,
thanks for the response!

[frobinson_splun]

You're welcome! Did this help answer your question? Or are you still wondering about the external link?

[alauri]

Actually yes, I'm still wondering if is it possible placing an external link into a message.

I went through the documentation and on Internet and I found the way to place a "local link" into a message.
For example, from my Python code, where I need to send a message to Splunk, I used the syntax [[/manager/search/control|Restart here]] to get a link to the restart page of Splunk instance (/en-US/manager/search/control is the path I got) and it works.

Now, I also need to do the same with an external link, the same I typed in the question. Did you look into this with your engineers?

Thank you very much @frobinson_splunk for your time!

[frobinson_splun]

Hi @alauri,
Thanks for the extra details! I'm currently tracking down an answer for you about the working external link. Should be able to provide more info shortly!

Thanks again,
@frobinson_splunk

[frobinson_splun]

Hi, @alauri:
After consulting with our engineering team, the short answer to your question is that external links within the message text are not currently supported. There might be a workaround, though, and I'm checking to see if there's something we can suggest for you.

Thanks!
@frobinson_splunk

[alauri]

Hi @frobinson_splunk,
thank you very much, your support was great and very clear!

I hope it will be possible to find a way to do that.

Many thanks again!!!
@alauri

[alauri]

Hi @frobinson_splunk,

I went through the Splunk source code and I found how to place an "external link" into a message.

Currently I work with Splunk 6.2.1 and, into the file utils.js under the folder /share/splunk/search_mrsparkle/exposed/js/, maybe I found regex for both "internal link" and "external link".
About the external link regex, I think it matches only links like

http://www.example.com

Regarding initial question I made, I don't think it is possible to place that kind of external link with that regex... for example, I tried to place below text into a message:

[mailto:example@example.com Example]

but the result I got it was just a copy and paste of that text into the message. Otherwise, when I placed this:

[http://www.example.com Example]

I got a correct link to an external page.
I hope my comment was clear and I'd like ask you if what I said was correct?

Thanks,
@alauri

[frobinson_splun]

Hi @alauri, thanks for this info. Let me run this all by the engineering team and I'll get back to you soon!
Best,
@frobinson_splunk

[frobinson_splun]

Hi, @alauri, just checking back in after talking with our engineers. Your workaround is fine for external links. It is currently supported for you to create an external link following the syntax you show above:
[http://www.example.com Example]

Adding in a "mailto" link is not currently supported at all, but our engineers think that this could be a great thing to enable down the road. We're looking into adding in this capability, so stay tuned!

Thanks again!