All Apps and Add-ons

Query Regarding using parameter q from URL in the view XML(Advaned XML)

tkadale
Path Finder

I am developing a small application. I have the following situation:
My first view shows a data for all the Users.
After clicking on that view it is redirected to separate view.
On this second view I want to show the data for the single User which
was clicked in First Graph.
I want use value of user which was clicked, from parameter q of URL,
in my drill down view.
I have searched it on Splunk answers.
The solution provided was, Sideview Utils modules.
How to use Sideview utils for this?
Can anybody help me!

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

It's hard to answer without more specifics, but I would start by reading the documentation in the Sideview Utils app, and view the XML source of the linking examples that it has.

Very quickly, it looks sort of like the following:

But first, you dont want to use the 'q' parameter at all. Actually using the 'q' parameter, or the 's' or 'sid' parameters will activate a bunch of core Splunk UI behavior that will interfere with the correct operation of the URLLoader module. Instead you'll have simple querystring args like '?user=bob'.

In view #1,

 ... 
 <module name="SimpleResultsTable">
   <module name="Redirector">
     <param name="url">second_view</param>
     <!-- $click.fields.user$ will grab the value of the 'user' field, from the table -->
     <param name="arg.user">$click.fields.user$</param>
     <param name="arg.earliest">$search.timeRange.earliest$</param>
     <param name="arg.latest">$search.timeRange.latest$</param>
   </module>
</module>

and in view 2:

<module name="URLLoader">
  <module name="HTML">
    <param name="html"><![CDATA[
      showing events for user=$user$
    ]]></param>
  </module>
  <module name="Search">
     <param name="search">sourcetype=something user=$user$ | (more search language...)</param>
     <module name="EventsViewer"></module>
  </module>
</module>

if you want view #2 to have a TextField or a Pulldown module to prepopulate the value of $user$, you just stitch in a TextField or a Pulldown module, give it <param name="name">user</param>, and nest it inside the URLLoader, and nest the other stuff like Search and SimpleResultsTable, inside it.

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

It's hard to answer without more specifics, but I would start by reading the documentation in the Sideview Utils app, and view the XML source of the linking examples that it has.

Very quickly, it looks sort of like the following:

But first, you dont want to use the 'q' parameter at all. Actually using the 'q' parameter, or the 's' or 'sid' parameters will activate a bunch of core Splunk UI behavior that will interfere with the correct operation of the URLLoader module. Instead you'll have simple querystring args like '?user=bob'.

In view #1,

 ... 
 <module name="SimpleResultsTable">
   <module name="Redirector">
     <param name="url">second_view</param>
     <!-- $click.fields.user$ will grab the value of the 'user' field, from the table -->
     <param name="arg.user">$click.fields.user$</param>
     <param name="arg.earliest">$search.timeRange.earliest$</param>
     <param name="arg.latest">$search.timeRange.latest$</param>
   </module>
</module>

and in view 2:

<module name="URLLoader">
  <module name="HTML">
    <param name="html"><![CDATA[
      showing events for user=$user$
    ]]></param>
  </module>
  <module name="Search">
     <param name="search">sourcetype=something user=$user$ | (more search language...)</param>
     <module name="EventsViewer"></module>
  </module>
</module>

if you want view #2 to have a TextField or a Pulldown module to prepopulate the value of $user$, you just stitch in a TextField or a Pulldown module, give it <param name="name">user</param>, and nest it inside the URLLoader, and nest the other stuff like Search and SimpleResultsTable, inside it.

0 Karma

tkadale
Path Finder

For above problem, will the Redirector Module of SideViewUtils be useful?? Can anybody help me how to use it?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...