If the event has a URL and you want to show the URL in a search table where you can make the URL a clickable link that will go to that URL, how do you do this?
Example: Field is URL in the event and you want to display that URL in a table search aka index = ... | table URL
I want to be able to click on that URL and go to the link as to having to copy the URL and manually paste it into a browser.
Is there a way to do this in the generic search results? AKA not via a dashboard?
No matter what I put in the field value it only lets me click it say "include/exclude in search results" and I'm thinking there's no way to override this.
<link> - No
<a href="> No
There is an example that demonstrates this in the Dashboard Examples
App on Splunkbase:
https://splunkbase.splunk.com/app/1603/
Hi @peterlandis,
Try this example. You need to prevent the URL escaping by adding a |n
ie. <link target="_blank">$row.URL|n$</link>
to the token to avoid Splunk adding its own prefix.
<dashboard>
<label>TokenTest</label>
<row>
<panel>
<table>
<search>
<query>| makeresults |eval URL="https://answers.splunk.com/index.html"</query>
<earliest>-5s@s</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">$row.URL|n$</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>
try taking a look at this, it should get you going
http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/DrilldownLinkToURL