- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- URLLoader Parameters
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
URLLoader Parameters
First of all, a huge thanks to Nick for developing sideview utils. If anyone hasn't used it, i highly recommend it. I'm running into an issue where my URL is not being kept updated, regardless of what parameters i'm using. Hopefully this is something simple to fix. The code below produces a form search with graphs and a table. I have it wired so that when a user cliks on a value on the table, like source ip for example, it relaunches the same page with that src ip already populated in the textfield. THIS IS GREAT. I wasn't able to do this without sideview. However, i want to take it a step further and allow further drill down. After a user clicks on one field, it relaunches the dashboard with the token added in the url, but if the user clicks on a different field on the table, it launches the search with only that newly clicked field, but it doesn't add it to the existing URL up top. I tried setting keepurlupdated to true and this had no effect. Maybe Nick can provide some insight into this. I suspect it has something to do with the fact that i'm not linking to another view and just using the same one. Let me know what you guys think. And if someone could fix my code to display properly here i would appreciate it. the code sample box never works correctly for me.
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="SideviewUtils" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="URLLoader" layoutPanel="panel_row1_col1" autoRun="True">
<param name="keepURLUpdated">True</param>
<module name="Pulldown" layoutPanel="panel_row1_col1">
<param name="name">index</param>
<param name="label">Index</param>
<param name="staticFieldsToDisplay">
<list>
<param name="value">MyValue</param>
<param name="label">MyLabel</param>
</list>
<list>
<param name="value">MyValue</param>
<param name="label">MyLabel</param>
</list>
</param>
<module name="TextField">
<param name="name">src</param>
<param name="float">left</param>
<param name="template">$value$</param>
<param name="label">Src IP</param>
<param name="default">*</param>
<module name="TextField">
<param name="name">spt</param>
<param name="float">left</param>
<param name="template">$value$</param>
<param name="label">Src Port</param>
<param name="default">*</param>
<module name="TextField">
<param name="name">dst</param>
<param name="float">left</param>
<param name="template">$value$</param>
<param name="label">Dst IP</param>
<param name="default">*</param>
<module name="TextField">
<param name="name">dpt</param>
<param name="float">left</param>
<param name="template">$value$</param>
<param name="label">Dst Port</param>
<param name="default">*</param>
<module name="TextField">
<param name="name">name</param>
<param name="float">left</param>
<param name="template">$value$</param>
<param name="label">Event Name</param>
<param name="default">*</param>
<module name="TextField">
<param name="name">signature</param>
<param name="float">left</param>
<param name="template">$value$</param>
<param name="label">Signature</param>
<param name="default">*</param>
<module name="TimeRangePicker">
<param name="searchWhenChanged">False</param>
<param name="label">Time Range</param>
<module name="SubmitButton">
<param name="allowSoftSubmit">True</param>
<param name="label">Search</param>
<module name="Search">
<param name="search">index="$index$" product="myproduct" OR product="myproduct2" src="$src$" spt="$spt$" dpt="$dpt$" dst="$dst$" name="$name$" signature="$signature$"</param>
<module name="JobStatus" />
<module name="HiddenPostProcess" layoutPanel="panel_row2_col1" group="Events over Time">
<param name="search">timechart count by events | rename NULL as Events</param>
<param name="groupLabel">Events over Time</param>
<module name="ViewstateAdapter">
<module name="HiddenFieldPicker">
<param name="strictMode">True</param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<param name="charting.chart">area</param>
<param name="charting.secondaryAxisTitle.text">Events</param>
<param name="charting.legend.placement">bottom</param>
<param name="charting.primaryAxisTitle.text">Time</param>
<module name="FlashChart">
<param name="width">100%</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="HiddenPostProcess" layoutPanel="panel_row2_col2" group="Top Appliances">
<param name="search">top dvchost</param>
<param name="groupLabel">Top Appliances</param>
<module name="ViewstateAdapter">
<module name="HiddenFieldPicker">
<param name="strictMode">True</param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<param name="charting.chart">pie</param>
<param name="charting.secondaryAxisTitle.text">Events</param>
<param name="charting.legend.placement">bottom</param>
<param name="charting.primaryAxisTitle.text">Time</param>
<module name="FlashChart">
<param name="width">100%</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="HiddenPostProcess" layoutPanel="panel_row3_col1" group="List of Events">
<param name="search"></param>
<param name="groupLabel">List of Events</param>
<module name="ViewstateAdapter">
<module name="HiddenFieldPicker">
<param name="fields">_time,dvchost,name,signature,src,spt,dst,dpt</param>
<param name="strictMode">True</param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="SimpleResultsTable">
<param name="count">50</param>
<param name="drilldown">all</param>
<param name="displayRowNumbers">true</param>
<module name="SubmitButton">
<param name="label">OK, redirect me</param>
<module name="Redirector">
<param name="url">IR_Investigation_Channel_Test</param>
<param name="arg.$click.name2$">$click.value2$</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well, keepURLUpdated won't help you here. What keepURLUpdated does, is that when you're changing Pulldown, TextField, Checkbox, TimeRangePicker and SearchBar values on the page without redirecting to a new URL, the URL of that page will quietly update with little #foo=bar tags.
This has two effects --
a) if the user ever clicks refresh or sends the current URL to someone else, the current state will be maintained.
b) The user's back and forward buttons in the browser will take them to and from successive states in the set of form elements.
However it doesn't mean that it automatically sends all arguments when the user does leave the page. I agree that the name's a little misleading. However the only arbiter of what arguments are sent when you drilldown from view A to view B, is the Redirector module.
So to take a trivial example, if you wanted Redirector to simply pass on any previously loaded value of foo, bar, baz, bat, (or a null value if none was defined) then you would do this:
<module name="Redirector">
<param name="url">some_view</param>
<param name="arg.foo">$foo$</param>
<param name="arg.bar">$bar$</param>
<param name="arg.baz">$baz$</param>
</module>
If you want the SimpleResultsTable click to merge in seamlessly with this set of args, no matter whether the table argument was a foo, bar or baz value, but still set the other args that might have been loaded from the URL, you'd do this:
<module name="ValueSetter">
<param name="name">$click.name$</param>
<param name="value">$click.value$</param>
<module name="Redirector">
<param name="url">some_view</param>
<param name="arg.foo">$foo$</param>
<param name="arg.bar">$bar$</param>
<param name="arg.baz">$baz$</param>
</module>
</module>
One inconsistency I just noticed is that for any given key $foo$, you're supposed to use $foo$ in all cases where the argument is used for search syntax, but $foo.rawValue$ in all cases where it ends up in Redirector modules and headers. But the URLLoader module only outputs the $foo$ keys. I'll put in a fix for this into the next Utils version, so that URLLoader outputs the $foo.rawValue$ keys as well.
If you want to do something like persisting truly any argument that you see in the URL, you could do this with a customBehavior. But like all customBehavior use cases, it's pretty easy if you know how and impossible until you do.
but such a customBehavior, as applied to a Redirector module, would look something like this in application.js.
if (typeof(Sideview)!="undefined") {
$(document).ready(function() {
Sideview.utils.forEachModuleWithCustomBehavior("sendOtherArgsToo", function(i,myRedirectorModule) {
myRedirectorModule.customEditArgs = function(context, normalArgs) {
// get all the keys in the querystring.
var qsDict = Sideview.utils.stringToDict(document.location.search.substring(1));
// layer in any additional keys that come after the hash char.
var hashDict = Sideview.utils.stringToDict(this.getCurrentHash());
// ready, set, mash.
for (key in hashDict) {
qsDict[key] = hashDict[key];
}
// now put them into the normalArgs only if there isn't a value already there.
// (being careful because we want things like table clicks to override old
// values in the URL if they collide.
for (key in qsDict) {
if (!normalArgs.hasOwnProperty(key)) {
normalArgs[key] = qsDict[key];
}
}
}.bind(myRedirectorModule);
});
});
}
There are some high level docs about customBehavior implementation, if you go to the 'Key Techniques > Other > Tools' page, you'll see a secret link at the bottom that'll take you to it.
What's Coming:
There's a completely different approach to this problem though. I've been working on this alternate approach, some pieces of it have been implemented for a while, but some other pieces dont exist yet and of course there's no documentation. The other approach though, is to have a CustomBehavior (or custom module TBD), that 'bounces' the click arguments from charts and tables, and sends them back upstream. When such impulses hit TextFields, Checkboxes, Pulldowns, those modules are already smart enough to select themselves to the matching value and things work out correctly. And when URLLoader has it's keepURLUpdated flag set, the click also gets captured in the hashtag up there. I havent actually implemented the 'bouncer' module yet but it's been done in a couple apps as a custom behavior at this point and the concept is sound. Email me if you want to pressure me into doing it sooner rather than later. 😃
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the quick reply, i'll give these suggestions a shot, though i haven't fooled around with customBehavior implementation yet.
.conf24 | Registration Open!
ICYMI - Check out the latest releases of Splunk Edge Processor
Introducing the 2024 SplunkTrust!
