Dashboards & Visualizations

How can I add link to external WHOIS resource?

digital_alchemy
Path Finder

I'm trying to create column with a link to WHOIS for the results of a search but I'm running into an error indicating that the "field" attribute is deprecated, any ideas on how to correct this?

A quick search didn't reveal a working solution.

Warning on line 9: Attribute "field" is deprecated

<dashboard>
  <label>*** Test WHOIS ***</label>
  <row>
    <panel>
      <table>
        <search ref="DMZ Inbound Traffic Greater Than 2 Std Deviations Over Mean">
        </search>
        <drilldown target="_blank">
          <link field="WHOIS">
            <![CDATA[ http://who.is/whois-ip/ip-address/$row.src_ip$ ]]>
          </link>
        </drilldown>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="count">30</option>
      </table>
    </panel>
  </row>
</dashboard>
Tags (3)
0 Karma

jeffland
SplunkTrust
SplunkTrust

You can put a condition around your link that checks which column is clicked:

<drilldown>
  <condition field="WHOIS">
    <link target="_blank">
         <![CDATA[ http://who.is/whois-ip/ip-address/$row.src_ip$ ]]>
    </link>
  </condition>
</drilldown>

See docs here.

0 Karma

digital_alchemy
Path Finder

I don't have an error after the changes but it also doesn't seem to provide a link to a WHOIS lookup.

0 Karma

jeffland
SplunkTrust
SplunkTrust

It should, the error has to be somewhere else then. See the following run-anywhere dashboards, one with an inline search:

<dashboard>
  <label>_temp drilldown link</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval WHOIS="foo" | eval src_ip="bar"</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <drilldown>
          <condition field="WHOIS">
            <link target="_blank">
              <![CDATA[ http://google.com/search?q=$row.src_ip$ ]]>
            </link>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

and same with a report:

<dashboard>
  <label>_temp drilldown link</label>
  <row>
    <panel>
      <table>
        <search ref="_temp report"></search>
        <drilldown>
          <condition field="WHOIS">
            <link target="_blank">
              <![CDATA[ http://google.com/search?q=$row.src_ip$ ]]>
            </link>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Both work for me.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...