All Apps and Add-ons

Sideview: Redirector link to take clicked value from my chart and popup a new window with the results

the_wolverine
Champion

I can't seem to get this to work -- the popup window ignores my clicked field (host) but accepts the timerange. I think I'm missing the syntax for my clicked field:

 <module name="Redirector">

                 <param name="url">flashtimeline</param>
                 <param name="popup">True</param>

                  <param name="arg.earliest">$search.timeRange.earliest$</param>
                  <param name="arg.latest">$search.timeRange.latest$</param>
                  <param name="arg.host">$host$</param>

                  <param name="arg.q"><![CDATA[index=main $host$  | stats count by host ]]></param>
              </module>
            </module>
            <module name="RedirectorLink">
              <param name="viewTarget">flashtimeline</param>
              <param name="popup">width=800px,height=600px;</param>
            </module>
          </module>
       </module>
   </module>

the_wolverine
Champion

Well, I got it to work by adding the ResultsValueSetter module. I knew how to do this with SimpleResultsTable, just not with chart click.

<module name="ResultsValueSetter">
             <param name="fields">host</param>
       <module name="Redirector">

                 <param name="url">flashtimeline</param>
                 <param name="popup">True</param>

                  <param name="arg.earliest">$search.timeRange.earliest$</param>
                  <param name="arg.latest">$search.timeRange.latest$</param>
                  <param name="arg.q"><![CDATA[index=main host=$host$  | stats count by host ]]></param>
              </module>
            </module>
            </module>
            <module name="ViewRedirectorLink">
              <param name="viewTarget">flashtimeline</param>
              <param name="popup">width=800px,height=600px;</param>
            </module>
          </module>
       </module>
   </module>
0 Karma

sideview
SplunkTrust
SplunkTrust

Clicked field says to me that this Redirector is living under a chart or table? And thus that this is a chart or table drilldown config?

In that case, yes the key that you're looking for wont be just $host$. Look in the Sideview Utils docs (inside the app itself), for the docs around linking, and also the docs around Table and Chart drilldown.

Here's also a quick summary for you below:

Table Drilldown:

If the field displayed in the table is "host":

If you're using Table you want $row.fields.host$. And if you have multiple nested clickable Tables, you can use the "name" param to change the "row" part to something else, ie "row" is just the default value of the optional "name" param.

If you're using SimpleResultsTable you want $click.fields.host$ (Note that Sideview Utils patches SimpleResultsTable to add this key) and you can likewise use the "drilldownPrefix" param to change the "click" part if you need to.

Chart Drilldown

And if you're using Chart drilldown, either JSChart or FlashChart, most often you want the "split by" field, aka the field in the legend, which is always $click.name2$. If you want the pie wedge or a bar in a simple bar chart, you'll want $click.value$. As an advanced topic, if you're plugging this back into a search, especially if it's a complex chart where you don't know the fields in advance, you might prefer to use $click.searchTerms$. Sideview Utils has a lot of fancy code to parse out exactly what the searchterms for the click should be and to quote things appropriately. (It can even figure out and unwind OTHER and NULL for you)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...