I have tried multiple methods to get a complex URL to work as a redirect. Unfortunately, there are a lot of different base URLs in my actual data so using multiple conditions is probably not a good option. It seems as though it wants no "/" in the URL field, only parameters.
<dashboard>
<label>URL Test</label>
<row>
<panel>
<table>
<search>
<query>| makeresults count=3
| streamstats count
| eval url = case(count=1,"https://bing.com",count=2,"https://google.com",count=3,"https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Aapache&cpe_product=cpe%3A%2F%3Aapache%3Alog4net&cpe_version=cpe%3A%2F%3Aapache%3Alog4net%3A1.2.9.0")
| eval site = case(count=1,"bing",count=2,"google",count=3,"nist")
| table site, url</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<fields>["site"]</fields>
<drilldown>
<eval token="u">replace($row.url$, "https://", ""</eval>
<link target="_blank">
<![CDATA[ https://$u$ ]]>
</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>
You need to make sure your $u$ token does not get encoded, so use the |n in the token
<![CDATA[ https://$u|n$ ]]>
See token filters
https://docs.splunk.com/Documentation/Splunk/9.0.3/Viz/tokens#Token_filters
Thank you so much! I had seen the similar items, but nobody had called out the functionality of what it was called or what it did. Your link was also very helpful. Thank you so much! I now am a bit smarter than I was which is a good way to start a Friday morning!
You need to make sure your $u$ token does not get encoded, so use the |n in the token
<![CDATA[ https://$u|n$ ]]>
See token filters
https://docs.splunk.com/Documentation/Splunk/9.0.3/Viz/tokens#Token_filters