I am working on a custom dashboard for one of our security tools that doesn't need anything fancy like it's own app. All I want to do is be able to "drilldown" on an event and have that take me to an external tool's url. Currently my xml for the dashboard looks something like this:index=tool earliest=1@d | table user score url | sort -score user, score 0
In the XML above, when I click on an event, it captures the url from the log, but it appends it to the Splunk url. How to I get it to just open the url? I have been working on this for a couple of days so any help is much appreciated!
↧