Creating external link from a splunk eventsviewer

Question

Is it possible to create an events viewer field in splunk as clickable? How do you create a javascript for the same task, I want a clickable link in an events viewer field say severity to www.google.com.

How can I do that? Any thoughts?

Answer 1

For Splunk 5.0+, take a look at the dynamic drilldowns for Splunk Dashboards example. You can create dynamic links based upon data in your results using a simple XML forms table.

<dashboard>
  <label>Demo: drilldown</label>
  <row>
    <table>
      <searchString>
        index=foursquare checkin.primarycategory.nodename=*
        | spath output=venue path=checkin.venue.name
        | spath output=badges path=checkin.badges{}.name
        | eval link="Yelp Search"
        | stats count as checkins sparkline values(badges)
              as "badges" values(link) as "links" by venue
        | sort -checkins
      </searchString>

      <format field="sparkline" type="sparkline">
        <option name="type">bar</option>
        <option name="height">30</option>
        <option name="barColor">green</option>
        <option name="colorMap">
          <option name="5:9">yellow</option>
          <option name="10:">red</option>
        </option>
      </format>
      <title>Top Venues</title>
      <drilldown>

        <!-- Mulitvalue field drilldown -->
        <link field="badges">
         /app/foursquare_vegas/vegas_badge_1?form.badge=$click.value2$
        </link>

        <link field="venue">
          /app/foursquare_vegas/vegas_venue_1?form.venue=$row.venue$
        </link>
        <link field="links">
          http://www.yelp.com/search?find_desc=$row.venue$&find_loc=Las+Vegas,+NV
        </link>
      </drilldown>

    </table>
  </row>  
</dashboard>

If this example doesn't achieve what you are after - you can always hook into the JS events using NullModule or invest some effort into learning SideView Utils integration.

Answer 2

The closest answer out of the box would be workflow actions, which would not be in the result table itself, but just before the event. Take a look at the docs for more. For formatting it exactly how you want, you would need to use sideview utils, which would make it easy to do via embedding search results in their HTML control