Splunk Search

How to create a drilldown from my dashboard table to an external URL that has to pick the hostname of the URL from the table?

krishnarajapant
Path Finder

Hi Experts,

I want to drilldown from my table in the dashboard to an external URL for which has to pick the hostname of the URL from the table hostname field.

Below is my drilldown code in table tag.

<condition field="service_name">
            <link>
              <![CDATA[

              http://$row.hostname$/runprocess.dsp?interface_instance_id=$row.interface_instance_id/]]>
           </link>
<condition>

When I hard-code the host name to specific host, then the drilldown is working as expected, whereas if I'm using variable, then drilldown behavior is not working.

Not sure what am I missing here.

-Krishna Rajapantula

0 Karma

somesoni2
Revered Legend

Try something like this

<dashboard>
  <label>Dynamic WebSite Launcher</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| gentimes start=-1 | eval site="google microsoft bing apple" | table site | makemv site | mvexpand site</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
         <option name="drilldown">row</option>    
        <drilldown target="_blank">          
             <link>
                 http://www.$row.site$.com
            </link>
       </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

krishnarajapant
Path Finder

Updated the code below in a screenshot.

-Krishna Rajapantula

0 Karma

krishnarajapant
Path Finder

Hi Experts,

Any solution available for the above query?

-Krishna Rajapantula

0 Karma

krishnarajapant
Path Finder

alt text

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...