All Apps and Add-ons

Sideview: Redirector link to take clicked value from my chart and popup a new window with the results

the_wolverine
Champion

I can't seem to get this to work -- the popup window ignores my clicked field (host) but accepts the timerange. I think I'm missing the syntax for my clicked field:

 <module name="Redirector">

                 <param name="url">flashtimeline</param>
                 <param name="popup">True</param>

                  <param name="arg.earliest">$search.timeRange.earliest$</param>
                  <param name="arg.latest">$search.timeRange.latest$</param>
                  <param name="arg.host">$host$</param>

                  <param name="arg.q"><![CDATA[index=main $host$  | stats count by host ]]></param>
              </module>
            </module>
            <module name="RedirectorLink">
              <param name="viewTarget">flashtimeline</param>
              <param name="popup">width=800px,height=600px;</param>
            </module>
          </module>
       </module>
   </module>

the_wolverine
Champion

Well, I got it to work by adding the ResultsValueSetter module. I knew how to do this with SimpleResultsTable, just not with chart click.

<module name="ResultsValueSetter">
             <param name="fields">host</param>
       <module name="Redirector">

                 <param name="url">flashtimeline</param>
                 <param name="popup">True</param>

                  <param name="arg.earliest">$search.timeRange.earliest$</param>
                  <param name="arg.latest">$search.timeRange.latest$</param>
                  <param name="arg.q"><![CDATA[index=main host=$host$  | stats count by host ]]></param>
              </module>
            </module>
            </module>
            <module name="ViewRedirectorLink">
              <param name="viewTarget">flashtimeline</param>
              <param name="popup">width=800px,height=600px;</param>
            </module>
          </module>
       </module>
   </module>
0 Karma

sideview
SplunkTrust
SplunkTrust

Clicked field says to me that this Redirector is living under a chart or table? And thus that this is a chart or table drilldown config?

In that case, yes the key that you're looking for wont be just $host$. Look in the Sideview Utils docs (inside the app itself), for the docs around linking, and also the docs around Table and Chart drilldown.

Here's also a quick summary for you below:

Table Drilldown:

If the field displayed in the table is "host":

If you're using Table you want $row.fields.host$. And if you have multiple nested clickable Tables, you can use the "name" param to change the "row" part to something else, ie "row" is just the default value of the optional "name" param.

If you're using SimpleResultsTable you want $click.fields.host$ (Note that Sideview Utils patches SimpleResultsTable to add this key) and you can likewise use the "drilldownPrefix" param to change the "click" part if you need to.

Chart Drilldown

And if you're using Chart drilldown, either JSChart or FlashChart, most often you want the "split by" field, aka the field in the legend, which is always $click.name2$. If you want the pie wedge or a bar in a simple bar chart, you'll want $click.value$. As an advanced topic, if you're plugging this back into a search, especially if it's a complex chart where you don't know the fields in advance, you might prefer to use $click.searchTerms$. Sideview Utils has a lot of fancy code to parse out exactly what the searchterms for the click should be and to quote things appropriately. (It can even figure out and unwind OTHER and NULL for you)

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...