Dashboards & Visualizations

Can a drilldown that redirects to an external site be done for multiple columns?

mcm10285
Communicator

I have the code below to drilldown the values of a specific field to an external website (e.g. google and ipvoid). For one field it will popout a new window and search in google. For another field, it will also popout a new window and search in IP void.

The closest I can get is use this.

<module name="SimpleDrilldown">

<param name="links">

<param name="Malware_Name">https://www.google.com/#q=$click.value2$&lt;/param>

<param name="IP">http:www.ipvoid.com/scan/$click.value3$/&lt;/param>

</param>

This results to both popup windows working. First field ("Malware_Name") is properly searched on google. Second field ("IP"), successfully redirects to www.ipvoid.com but it takes the "$click.value3$" literally.

So the question is, is this possible? Is there an argument that will replace "click.value3" and still make both drilldowns work?

Thanks.

Tags (2)
1 Solution

mcm10285
Communicator

Found it, was right under my nose. I used $row.fieldname$ instead of the $click.value3$ (which is I believe is non-existent)...by the way, the popups don't really work (not in code level) unless ctrl-click is done.

Now the next questions is:

1.Is it possible to search for one value in two external sites launched at the same time?

I guess that's for another topic.

View solution in original post

0 Karma

mcm10285
Communicator

Found it, was right under my nose. I used $row.fieldname$ instead of the $click.value3$ (which is I believe is non-existent)...by the way, the popups don't really work (not in code level) unless ctrl-click is done.

Now the next questions is:

1.Is it possible to search for one value in two external sites launched at the same time?

I guess that's for another topic.

0 Karma

sideview
SplunkTrust
SplunkTrust

If $row.fieldname$ is defined then there's a Sideview Table module in there, and if you have that then you should definitely be using the Redirector module instead of the SimpleDrilldown module. Check out the docs on linking in Sideview Utils itself. And make sure you're on the latest Sideview Utils - 3.2.5. Once in a while I run into people who are still using the ancient 1.3.5 version.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...