All Apps and Add-ons

SideView Redirector Open in Search to events tab

steverazor
Explorer

I was able to use the Redirector module in SideView to get an "Open in Search" link using the answer provided for this question.

However, I have a further question. Is it possible to force the new search window to open to the "events" tab using one of the arg.* parameters?

I noticed that when I have the page displaying the events tab, the url contains the parameter "display.general.type=events". I attempted to use arg.display.general.type for one of the arguments, but it still opens in the "statistics" tab.

Any advice is much appreciated 🙂

0 Karma

sideview
SplunkTrust
SplunkTrust

I'm afraid that I don't think there's a way to make Splunk's core "search" view always open in the Events tab. What the view uses to make the determination is the nature of the search itself. If the search is just a raw search or if it contains only streaming and non-transforming search commands, then the search will open in the events tab. On the other hand if it has a transforming command like "stats" or "timechart" or even a non-streaming command like "| table *", then it will open in the "Statistics" tab.

What could be added to Sideview Utils, is a special key much like the special keys we already add, like $results.sid$ or $results.doneProgress$, that would be $results.eventSearch$. This could report the "eventSearch" property from the dispatched job. Splunk actually records the non-streaming transforming portion of the search into this property, and we could make it available for this kind of use case. In this case, instead of

<param name="arg.q">search $search$</param>

you would have

<param name="arg.q">$results.eventSearch$</param>

This would discard any commands like stats/timechart that are non-streaming commands and then the search would open in the events tab. Like the other $results.*$ keys, it would only be defined once the UI had actually received information back from the server, so for certain use cases where you need the information only moments after the search dispatches, it won't be there.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...