All Apps and Add-ons

SideView Utils Drilldown by SingleValue in Advanced XML

_gkollias
SplunkTrust
SplunkTrust

I'm looking for a module reference to add a redirector to a singlevalue in advanced xml

Here is my XML Sample - Note the question marks in the redirector module:


<![CDATA[

| stats sum(count) as count | eval count = tostring(count,"commas")  ]]>

</param>


count
Transaction Count
range

cg_diversity_channel_detail

$click.???$


Do you know what I can add there so the drilldown will work? Thanks!!

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

You certainly can use the HTML module to replace the SingleValue module.

However a slightly better way is to use the Link module with a ResultsValueSetter module here.

Link is a bit newer than HTML and it's a bit easier to work with. Plus with the HTML module you have to worry about url encoding because you're creating the <a href="foo"> tag yourself. With Link you can just delegate all that stuff to Redirector...

<module name="HiddenPostProcess">
  <param name="search"><![CDATA[ 
  | stats sum(count) as count last(someOtherField) as someOtherField | eval count = tostring(count,"commas")  ]]>
  </param>

  <module name="ResultsValueSetter">
    <param name="fields">count,someOtherField</param>

    <module name="Link">
      <param name="label">$count$ Transaction Count</param>

      <module name="Redirector">
        <param name="url">cg_diversity_channel_detail</param>
        <param name="arg.someOtherField">$someOtherField$</param>
      </module>
    </module>
  </module>

There are separate docs for both ResultsValueSetter and Link.

Link does support its own internal $results[0].fieldName$ syntax, and you can use this to quickly grab fields from the first result row for its label and cssClass params. (cssClass btw can thus do what range does for SingleValue)

Here ResultsValueSetter is employed though, to pull down the field values for both "count" as well as "someOtherField", so that we can use the latter in the downstream Redirector.

UPDATE: If you dont need to pass any field values in the URL, but only show them in the label, then you dont need the ResultsValueSetter module and you can use the $results[0].count$ syntax in the Link module.

<module name="HiddenPostProcess">
  <param name="search"><![CDATA[ 
  | stats sum(count) as count | eval count = tostring(count,"commas")  ]]>
  </param>

    <module name="Link">
      <param name="label">$results[0].count$ Transaction Count</param>

      <module name="Redirector">
        <param name="url">cg_diversity_channel_detail</param>
      </module>
    </module>
  </module>

View solution in original post

sideview
SplunkTrust
SplunkTrust

You certainly can use the HTML module to replace the SingleValue module.

However a slightly better way is to use the Link module with a ResultsValueSetter module here.

Link is a bit newer than HTML and it's a bit easier to work with. Plus with the HTML module you have to worry about url encoding because you're creating the <a href="foo"> tag yourself. With Link you can just delegate all that stuff to Redirector...

<module name="HiddenPostProcess">
  <param name="search"><![CDATA[ 
  | stats sum(count) as count last(someOtherField) as someOtherField | eval count = tostring(count,"commas")  ]]>
  </param>

  <module name="ResultsValueSetter">
    <param name="fields">count,someOtherField</param>

    <module name="Link">
      <param name="label">$count$ Transaction Count</param>

      <module name="Redirector">
        <param name="url">cg_diversity_channel_detail</param>
        <param name="arg.someOtherField">$someOtherField$</param>
      </module>
    </module>
  </module>

There are separate docs for both ResultsValueSetter and Link.

Link does support its own internal $results[0].fieldName$ syntax, and you can use this to quickly grab fields from the first result row for its label and cssClass params. (cssClass btw can thus do what range does for SingleValue)

Here ResultsValueSetter is employed though, to pull down the field values for both "count" as well as "someOtherField", so that we can use the latter in the downstream Redirector.

UPDATE: If you dont need to pass any field values in the URL, but only show them in the label, then you dont need the ResultsValueSetter module and you can use the $results[0].count$ syntax in the Link module.

<module name="HiddenPostProcess">
  <param name="search"><![CDATA[ 
  | stats sum(count) as count | eval count = tostring(count,"commas")  ]]>
  </param>

    <module name="Link">
      <param name="label">$results[0].count$ Transaction Count</param>

      <module name="Redirector">
        <param name="url">cg_diversity_channel_detail</param>
      </module>
    </module>
  </module>

_gkollias
SplunkTrust
SplunkTrust

Good call.We have version 1.3.5 🙂 That'll do it

0 Karma

sideview
SplunkTrust
SplunkTrust

Yes Link can do that too. Link just keeps the push from propagating downstream until the link is clicked. Whether or not the link "goes" to a new page or not is just a matter of whether there is a Redirector module downstream from the Link module. As such you can think of it like a Button module... Check out the Link documentation and examples for more info. Also if the page hangs saying "Loading...", then there is a JS error. Make sure you have the latest Sideview Utils. Link came out in 2.7

_gkollias
SplunkTrust
SplunkTrust

I'm finding that Link just creates a link for users to access a different page. I actually want to click a single value - the actual number - and drill down in to those. Is that possible?

0 Karma

_gkollias
SplunkTrust
SplunkTrust

Thanks guys! There is still something up with Link.. it doesn't seem to like my page, as it keeps hanging on "Loading". I will continue to play around with this and follow up with what I come up with. If you have anymore feedback please let me know! UPDATE: Essentially these SingleValues will represent the status of a transaction (Success, Failure, Error, Hold, Reprocess, etc.) and I would like to also drill down by status - that is when I will add that passing variable "$status$"

0 Karma

sideview
SplunkTrust
SplunkTrust

somesoni2 has it right. I wasn't sure if you needed to use any field values in the URL you were sending the user to, but the answer seemed incomplete without it. I'll update my answer for the simpler version where no field values are used in the URL.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If you don't need anything to be passed to your view "cg_diversity_channel_detail", your don't have to define or pass it. Generally when you drilldown you pass some value to specify from where it has come/what it should display in view it redirects to.

0 Karma

_gkollias
SplunkTrust
SplunkTrust

Thank you for your response. I'm a bit confused to why I need to add another field (i.e. "someOtherField") in order to do a drilldown from a singleValue. Or, is it that I need to re-define "count"? Also, what you have suggested doesn't seem to work with my page. The dashboard hangs on loading

0 Karma

somesoni2
SplunkTrust
SplunkTrust

See this. (use Sideview HTML module instead of SingleValue module, for dynamic drilldown)

http://answers.splunk.com/answers/56263/singlevalue-drilldown-search-containing-value-displayed-on-s...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...