All Apps and Add-ons

Can I use the redirector module to open a different url/view based on where a user clicks in the SimpleResultsTable?

0waste_splunk
Communicator

Hi,

I have a dashboard which show's results in a SimpleResultsTable. I have set up a drilldown param to all in SimpleResultsTable. My Output will look like as follow:

A B C

x y z
1 2 3

Now what I want is if a user clicks on x, then it should open a url, and if a user clicks on y, then it should open some other url or view. I know how to pass x or y using $row.filed.value$, but I want a different url or view based on the column where the user clicks.

Any help or ideas are appreciated.

FYI: Currently, I am just able to use only one view or column where I can pass the clicked value.

Thanks

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I recommend taking a step back and looking at Table Embedding to solve this problem.

Here is a simple config that adds two columns to a Table. In each column is a link, and by clicking the links the user can either search a particular field value in Google, or in Bing.

<module name="Search" autoRun="True" layoutPanel="panel_row1_col1">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group="per_sourcetype_thruput" | rename series as sourcetype | table sourcetype | fillnull google bing value="value not used"
  ]]></param>

  <module name="Pager">

    <module name="Table">

      <module name="HTML" group="row.fields.google">
        <param name="html"><![CDATA[
          <a href="http://google.com?q=$row.fields.sourcetype$">Google it</a>
        ]]></param>
      </module>

      <module name="HTML" group="row.fields.bing">
        <param name="html"><![CDATA[
          <a href="http://www.bing.com/search?q=$row.fields.sourcetype$">Bing it</a>
        ]]></param>
      </module>

    </module>
  </module>
</module>

But looking at this, you'll probably wonder "why are there two columns at all. If we can render arbitrary html and links, why don't we just put both the link tags into the same table cell? So here's a version that does exactly that:

<module name="Search" autoRun="True" layoutPanel="panel_row1_col1">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group="per_sourcetype_thruput" | rename series as sourcetype | table sourcetype | fillnull search value="value not used"
  ]]></param>

  <module name="Pager">

    <module name="Table">

      <module name="HTML" group="row.fields.search">
        <param name="html"><![CDATA[
          <a href="http://google.com?q=$row.fields.sourcetype$">Google it</a>  

          <a href="http://www.bing.com/search?q=$row.fields.sourcetype$">Bing it</a>
        ]]></param>
      </module>

    </module>
  </module>
</module>

Table Embedding is extremely powerful and flexible, and like almost all the features in Sideview Utils, it has it's own docs page with working examples, inside the Sideview Utils app itself.

remember to always get the real Sideview Utils from the Sideview website rather than the very old version on apps.splunk.com.


Another way that people sometimes try is to hack together a solution with the legacy SimpleResultsTable module but I do not recommend this. For the record though, you could use SimpleResultsTable module's weird ability to highlight/select both rows and columns, (setting its drilldown param to "all"), and then they try and fish out the column that the user clicked using the $click.name2$ token.

The problem usually is that there are only a couple columns where the given behavior is desired (in this case clickability), and the problem becomes how to turn off the behavior for the others.

You could in theory do this though, use the old SimpleResultsTable module and then have some drilldown modules like ValueSetter try and sort this out with the ValueSetter's conditional logic. and then pass to a Redirector. However I do not recommend this.

View solution in original post

sideview
SplunkTrust
SplunkTrust

I recommend taking a step back and looking at Table Embedding to solve this problem.

Here is a simple config that adds two columns to a Table. In each column is a link, and by clicking the links the user can either search a particular field value in Google, or in Bing.

<module name="Search" autoRun="True" layoutPanel="panel_row1_col1">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group="per_sourcetype_thruput" | rename series as sourcetype | table sourcetype | fillnull google bing value="value not used"
  ]]></param>

  <module name="Pager">

    <module name="Table">

      <module name="HTML" group="row.fields.google">
        <param name="html"><![CDATA[
          <a href="http://google.com?q=$row.fields.sourcetype$">Google it</a>
        ]]></param>
      </module>

      <module name="HTML" group="row.fields.bing">
        <param name="html"><![CDATA[
          <a href="http://www.bing.com/search?q=$row.fields.sourcetype$">Bing it</a>
        ]]></param>
      </module>

    </module>
  </module>
</module>

But looking at this, you'll probably wonder "why are there two columns at all. If we can render arbitrary html and links, why don't we just put both the link tags into the same table cell? So here's a version that does exactly that:

<module name="Search" autoRun="True" layoutPanel="panel_row1_col1">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group="per_sourcetype_thruput" | rename series as sourcetype | table sourcetype | fillnull search value="value not used"
  ]]></param>

  <module name="Pager">

    <module name="Table">

      <module name="HTML" group="row.fields.search">
        <param name="html"><![CDATA[
          <a href="http://google.com?q=$row.fields.sourcetype$">Google it</a>  

          <a href="http://www.bing.com/search?q=$row.fields.sourcetype$">Bing it</a>
        ]]></param>
      </module>

    </module>
  </module>
</module>

Table Embedding is extremely powerful and flexible, and like almost all the features in Sideview Utils, it has it's own docs page with working examples, inside the Sideview Utils app itself.

remember to always get the real Sideview Utils from the Sideview website rather than the very old version on apps.splunk.com.


Another way that people sometimes try is to hack together a solution with the legacy SimpleResultsTable module but I do not recommend this. For the record though, you could use SimpleResultsTable module's weird ability to highlight/select both rows and columns, (setting its drilldown param to "all"), and then they try and fish out the column that the user clicked using the $click.name2$ token.

The problem usually is that there are only a couple columns where the given behavior is desired (in this case clickability), and the problem becomes how to turn off the behavior for the others.

You could in theory do this though, use the old SimpleResultsTable module and then have some drilldown modules like ValueSetter try and sort this out with the ValueSetter's conditional logic. and then pass to a Redirector. However I do not recommend this.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...