All Apps and Add-ons

Using ResultsActionButtons with Sideview

David
Splunk Employee
Splunk Employee

I have a Sideview based report builder, and I want to provide users the ability to export results, link to results, save reports, and all the wonder that's provided by ResultsActionButtons. The export and save work, and GetLink gives me an ostensibly acceptable url, with the SID, but it doesn't get populated into the SimpleResultsTable.

It appears that my first pulldown-populating search is grabbing the search (which it then fails to use). I've tried using ValueSetter to set the SID to empty, set the search to empty, and set the search to , but I can't seem to get it to line up correctly.

How should I proceed with this? (Is the answer that there is a less-ugly Sideview version of the ResultsActionButtons?)

1 Solution

sideview
SplunkTrust
SplunkTrust

The quickest solution is to put a displayView="charting" into your <view> tag. Although this means pretty much all subsequent interaction will dump the user into the charting view, and they will have only that one search box and a TimeRangePicker module, the good news is that it will work. You could also in theory make a view that has no SearchBar nor TimeRangePicker, and that is thus a read-only view, and then set that as the displayView.

The better solution is the approach taken by various Sideview Apps -- Splunk for Cisco CDR, Sideview Web Analytics and Sideview Process Historian. However that approach is quite involved and involves adding 2 extra keys to savedsearches.conf, applying patches to a number of pieces of core splunk functionality from within application.js, and manually redirecting the user from all ?s=foo URLs to ?search.name=foo. As for the ?sid=123143121 URLs, I havent gotten around to making those work even in my own apps so unless I can replace them with sideview-style links, i just take them away entirely.

What all those patches and overrides do is override Splunk's viewstate systems and resurrection systems to instead allow the Sideview prepopulation to take over.

One thing to note, is that especially if you turn 'keepURLUpdated' on in the URLLoader module, then to "send a link" to someone, you can just copy and paste the URL and everything will prepopulate correctly when you send it to someone else. Likewise "saving a search" can arguably be as simple as bookmarking it in your browser. Of course scheduling an alert is a different story, but just for that one piece a read-only view, or sending the user to charting, might be acceptable.

View solution in original post

sideview
SplunkTrust
SplunkTrust

The quickest solution is to put a displayView="charting" into your <view> tag. Although this means pretty much all subsequent interaction will dump the user into the charting view, and they will have only that one search box and a TimeRangePicker module, the good news is that it will work. You could also in theory make a view that has no SearchBar nor TimeRangePicker, and that is thus a read-only view, and then set that as the displayView.

The better solution is the approach taken by various Sideview Apps -- Splunk for Cisco CDR, Sideview Web Analytics and Sideview Process Historian. However that approach is quite involved and involves adding 2 extra keys to savedsearches.conf, applying patches to a number of pieces of core splunk functionality from within application.js, and manually redirecting the user from all ?s=foo URLs to ?search.name=foo. As for the ?sid=123143121 URLs, I havent gotten around to making those work even in my own apps so unless I can replace them with sideview-style links, i just take them away entirely.

What all those patches and overrides do is override Splunk's viewstate systems and resurrection systems to instead allow the Sideview prepopulation to take over.

One thing to note, is that especially if you turn 'keepURLUpdated' on in the URLLoader module, then to "send a link" to someone, you can just copy and paste the URL and everything will prepopulate correctly when you send it to someone else. Likewise "saving a search" can arguably be as simple as bookmarking it in your browser. Of course scheduling an alert is a different story, but just for that one piece a read-only view, or sending the user to charting, might be acceptable.

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...