Drilldown from one of three tables to one table of results

[kmattern]

Running Splunk 5.0.4.

I have three tables displaying in one panel, each table in a different group. There is a single column named Publication in each table. Each table also has a time picker so that different time ranges can be displayed in each table.

In a second panel I want to display a single table that will change based on the publication selected for drilldown on one of the three tables. But when I drilldown from more than one table I get up more than one output table in the second panel. They are stacked vertically.

I figure that if I nest my modules properly I should be able to display my drilldown results on only one table.

I'm using Sideview Utils 2.6

[sideview · Accepted solution]

Yes. This is a perfect use case for the Gate module. Specifically for the functionality it has around its "to" and "id" params.

There is a page of documentation and working examples inside the Sideview Utils app itself

"Module Documentation > The Gate Module > Gate - Complex Drilldowns"

but to give you the gist of it here - you put a Gate module as the bottommost module in each of the 3 drilldown configs of the left hand side. So three Gate modules total there. You can put them just inside the Table modules or if there are other necessary bits under each Table like ValueSetter modules, inside those necessary modules. Those Gate modules should have no downstream modules.

Give each of them a <param name="to">rightSide</param>

Now put one Gate module upstream from your Table config on the right side and give that one

<param name="id">rightSide</param>

Then each of the three drilldowns on the left hand side will push to that single Table on the right side.

you also can nest the right side Gate module inside some other stuff, and that'll all work as you expect too, in that the tokens will all merge correctly and if a $foo$ token comes from both the Gate and from the normal upstream modules, the Gate value will override. So in other words you can mix communication via Gate modules with normal downstream communication and it merges fine.

[kmattern]

That's great. It works like a charm.

Thanks Nick