tourl Search Operator
tourl operator provides you the ability to assign a short name that describes the URL. It is similar to creating a href for the URL with a short name. URLs are generally long and they don't tell you what information is displayed when the URL is opened. A common benefit of using this operator is to provide a description of a URL to display in dashboards.
tourl(<url_column_name>, <url_short_name_column>) as <field>
tourl(<url_column_name>, <url_short_name_column>, <url_short_name_prefix>, <url_short_name_suffix>) as <field>
url_column_nameis the column having the URL to which you want to assign a short name.
url_short_name_``columnis the short name for the URL. It can be a static name that you specify, or it can be a variable that uses a value from a column.
url_short_name_prefix(optional) is the prefix, if any, to the short name. Requires suffix.
url_short_name_suffix(optional) is the suffix, if any, to the short name. Requires prefix.
- If you choose to specify one optional parameter, you must specify both the optional parameters - prefix and suffix. You should provide an empty string ("") if you don't have a value for one.
- Only fully-formed URLs (for example,
https://google.com) are supported as values for
- For the link to be clickable your query needs to aggregate by the returned field.
- You can only specify a single URL.
tourldoes not support merging multiple outputs into a single field.
When your URL points to another Sumo Logic feature from your account, such as a Dashboard (New), Search, Traces, or Collection page, you will have the option to open the link in another Sumo Logic tab or browser tab.
Right-click the link to view the tab-options menu:
If you don't see the menu it is not a supported link.
- The URL must be from the same host.
- The menu isn't available in full-screen mode.
Providing a static name as short name
If you’re sharing the Akamai Denials by Host search query in a dashboard with others, you can use the tourl operator to add a href to the URL in the dashboard. You’ll run this query to generate the short name:
| tourl("https://www.sumologic.net/ui/#section/search/H10KMVHzntXo9PrFAumuFemdU27f2iqU7bA3U7Lq", "Akamai Denials by Host") as AkamaiQuery
| count AkamaiQuery
When you add this to a dashboard, you’ll see the short name. When you click the link, it will open the Akamai denials by host search query.
Using a column for short name, and a prefix
In the dashboard of failed scheduled searches, you can use the tourl operator to display the time when the scheduled searches failed and linking it to the search URL, instead of displaying the URL of the scheduled searches.
You’ll run this query to generate the short name:
_index=sumologic_audit class=scheduled_search action=FINISH status=FAILURE
| where _sourceCategory="scheduled_search"
| KV "SchTime", "Url"
| tourl(Url, SchTime,"Scheduled search failed at: ","") as urlfailed
| count by urlfailed
Notice the query uses the value
"Scheduled search failed at: " as the value for the prefix optional parameter, and an empty string ("") for the suffix parameter.
The query result will be:
When you add the result to a dashboard, you’ll see the short name. When you click the link, it will take you to the scheduled search query.