Dashboards & Visualizations

With a dedicated assigned credential is there a way to create splunk queries on the fly and present it as hyperlinks in a web page .

senrag
New Member

The idea here is. I am creating a Web Console which manages certain video content based management. All the logs are in Splunks.

There is a Dashboard Menu item in my Web Page which holds a sub menu retrieve all purchases given a Device Id here i want to present an hyperlink that is create splunk queries on the fly and present it as hyperlinks in a web page.

When user click on this link it opens Splunk with (auto sign in and query in place and thereby showing the data of interest.

Appreciate your help on this initiative if doable or not.

Tags (1)
0 Karma

senrag
New Member

Thanks will try these and get back to you all.

0 Karma

Richfez
SplunkTrust
SplunkTrust

If you have a dedicated, local set of credentials to use and you've turned on enable_insecure_login=true on the server involved (which you would do in a local copy of the web.conf on the system hosting the dashboards/panels/searches you want to display - ask if you need help with that), then you can try this:

Say I have a local user "embedded" with a password "embeddedPassword", OK?

And, I have a search I want to link to that should auto-launch. We'll use the base link from that and modify it to autologin. Let's say that search is

https://myserver.domain.com/en-US/app/network_traffic/internal_and_external_traffic?form.field1.earl...

To get that URL I just filled out the form and clicked submit, that's what was up in the address bar.

So, there are TWO things you have to do to this URL. First, you have to add in your autologin stuff. For my username/password, I'll need to put into the middle of that, right between "en-US/" and "app/", "account/insecurelogin?username=embedded&password=embeddedPassword&return_to="

That search is now

https://myserver.domain.com/en-US/account/insecurelogin?username=embedded&password=embeddedPassword&...

Then we have to replace any ampersands in the return to portion of the url with %26, otherwise Splunk strips them out when passing the url around for the auto-login stuff. Like this.

https://myserver.domain.com/en-US/account/insecurelogin?username=embedded&password=embeddedPassword&...

So, if you were to click that, - obviously click YOUR version of that 🙂 - you'll get that page open up, automatically log in and then launch.

Now, to make it do mildly different OTHER things: You'll notice that even though we started from a URL we got from a Splunk page, you can in YOUR link change some portions to anything you want. So you could take that trailing bit...

?form.field1.earliest=-24h%40h%26form.dvc=1.2.3.4

And make it different, like say instead of last 24 hours for device 1.2.3.4 we wanted to do last 60 minutes for device 5.4.3.2...

?form.field1.earliest=-60m%40h%26form.dvc=5.4.3.2

And that's it.

Well, that's it for this posting, anyway. If this helps you, or if niketnilay's answer helps, please let us know and I'll convert whichever one (or maybe both) into actual answers so you can accept one of them.

If you need more help with specifics, just ask!

Happy splunking!
-Rich

0 Karma

senrag
New Member

Thanks both of you i guess this will help. Will try and let you know.

0 Karma

niketn
Legend

@senrag, maybe you need Embedded Reports to show Splunk Report in external webpage:

https://docs.splunk.com/Documentation/Splunk/latest/Report/Embedscheduledreports
https://docs.splunk.com/Documentation/Splunk/latest/Report/Optionalconfigurationforembeddedreports#B...

If not please explain further your requirement.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

senrag
New Member

@niketnilay thanks for your response.

Is there a way to pass params of interest on the fly to Embedded reports.

Since in my use case there could me "N" number of customers for whom i want to extract the purhcases by their User Id or Device Id.

It will not help to create N number of embedded reports as the customer count increases. Let me knew if you clear.

0 Karma

niketn
Legend

If your use case is to have same dashboard reused by several customers with their User Id or Device Id, you should add these dropdowns to all dashboards of your app. For doing this you can re-use Pre-built Panels, so that the code gets maintained from a single place.

Then Take the value of either User Id or Device Id (which ever is provided to drilldown to another dashboard with dropdown values as query strings. Is there one to one mapping between User Id and Device Id? If so then when one dropdown is selected, the other value can be defaulted. Please let me know if this makes sense or you want sample run anywhere dashbaords.

You might not need Embedded Reports (as you can not convert them to forms with inputs to allow customer selection.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...