Raw HTML code in sideview HTML module

nhamel · ‎06-27-2013

Hi all,
I am processing exports of a bug tracking system (HPQC) in our Splunk.
The events contain a field with the "Comments" on the bug, which is delivered in pure HTML code.
For example:

Comments="<html><body>Bug details: This bug occurs every Monday. Modules affected: </body></html>"

I want to link from the bug list in a Table module so that the comments of the selected bug is displayed using the original HTML code, in this example including the br and underline tags.

I can get my comments into a new Table module, but then the HTML tags are treated as normal text.

But I cannot get the comments into a HTML module. I can get all other fields to the HTML, for example the bug ID with $row.fields.HPQC_ID$ or the assignee, but I cannot get the comments field displayed.

search | table HPQC_ID, Ordering, MyComments

< module name="HTML"> 
< param name="html">
< span>Showing details for $row.fields.HPQC_ID$ </span>
< span>$row.fields.MyComments.Value$</span>

Is there any way to render pure HTML from an event to the HTML module?

Thanks
Norbert

sideview · ‎06-27-2013

I think the only problem is that you're using $row.fields.MyComments.Value$. That extra .Value on the end makes it a meaningless key. Replace that with just $row.fields.MyComments$.

The HTML module doesn't do any encoding on embedded $foo$ tokens, so it's quite common to use HTML modules to display actual HTML from the indexed data.

For a wider range of similar use cases, you might check out the ResultsValueSetter docs in Sideview Utils, also the HTML docs to familiarize yourself with the $results[0].someField$ syntax in the HTML module, and even the Table Embedding docs, to see how you can embed that rendered (ie non-escaped) HTML into tablecells in the Table module itself.

Raw HTML code in sideview HTML module

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

They're back! Join the SplunkTrust and MVP at .conf24

Enterprise Security Content Update (ESCU) | New Releases