Dashboards & Visualizations

Dashboard Outside URL off Title

ccsfdave
Builder

Greetings,

I have a table that results in:

Title URL
Blah http://blah.com

So what I would like to do is create a Dashboard that just shows the title and when it is clicked on, it goes to the corresponding URL.

Thanks.

Dave

Tags (3)
0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

Assuming you don't want to write and maintain a bunch of custom Javascript, I think you have to use the Advanced XML and the Sideview Utils app. Possibly there's a way with just the core advanced XML but I don't know of a way to not display the URL in the table then.

Download and install the latest Sideview Utils app (from here http://sideviewapps.com/apps/sideview-utils ). Read the first few intro pages of the app itself, and then read the documentation around the Table module.

Here's a quick standalone example view.

<view autoCancelInterval="90" isVisible="False" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <label>hiding URL field, but using it in drilldown clicks</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="Search" layoutPanel="panel_row1_col1">
    <param name="search"><![CDATA[
      your search here
    ]]></param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">URL</param>
        <module name="Redirector">
          <param name="url">$row.fields.URL$</param>
        </module>
      </module>
    </module>
  </module>
</view>

View solution in original post

ccsfdave
Builder

The XML was slightly different but pretty darn close to what you gave me above.

I had to adjust it ever so slightly. I added this to the module name tag which made the search run and gave the panel a title:

autoRun="True" group="US-CERT RSS"

In the <![CDATA[your search here]]> tag, I didn't need the CDATA, just the search unquoted.

Other than that, thanks for having me scratch the surface of sideview - I will definitely read more over the next few weeks. It sounds SO powerful!

0 Karma

sideview
SplunkTrust
SplunkTrust

Assuming you don't want to write and maintain a bunch of custom Javascript, I think you have to use the Advanced XML and the Sideview Utils app. Possibly there's a way with just the core advanced XML but I don't know of a way to not display the URL in the table then.

Download and install the latest Sideview Utils app (from here http://sideviewapps.com/apps/sideview-utils ). Read the first few intro pages of the app itself, and then read the documentation around the Table module.

Here's a quick standalone example view.

<view autoCancelInterval="90" isVisible="False" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <label>hiding URL field, but using it in drilldown clicks</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="Search" layoutPanel="panel_row1_col1">
    <param name="search"><![CDATA[
      your search here
    ]]></param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">URL</param>
        <module name="Redirector">
          <param name="url">$row.fields.URL$</param>
        </module>
      </module>
    </module>
  </module>
</view>

ccsfdave
Builder

The XML was slightly different but pretty darn close to what you gave me above.

I had to adjust it ever so slightly. I added this to the module name tag which made the search run and gave the panel a title:

autoRun="True" group="US-CERT RSS"

In the <![CDATA[your search here]]> tag, I didn't need the CDATA, just the search unquoted.

Other than that, thanks for having me scratch the surface of sideview - I will definitely read more over the next few weeks. It sounds SO powerful!

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...