I'd like to drilldown parameter send to textfield

[ilove275]

I want to make a drilldown. If I click one row in a first table chart, then "EventName" field's value is returned to the textfield in second table.

How can I do that?

<view template="dashboard.html">
  <module name="SideviewUtils" layoutPanel="appHeader" />
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="true">
    <param name="search">index=TMS | fields sourcetype EventName Count | stats sum(Count) as count by EventName sourcetype | fields sourcetype EventName count 
| join type=inner EventName [SEARCH index=lookup sourcetype=major_event earliest=-1m@m | fields - sourcetype]  
| table sourcetype EventName count ATTACK_NAME  | sort - count | APPEND [ search  index=fireeye | rename cef_dvendor as sourcetype | rename cef_name as ATTACK_NAME | rename sname as EventName | stats count by EventName,ATTACK_NAME,sourcetype | sort - count]|table EventName ATTACK_NAME sourcetype count</param>
    <param name="earliest">-4h</param>

    <!-- when the user clicks on this table they will be selecting a 'group' value. -->
    <module name="SimpleResultsTable" layoutPanel="panel_row1_col1_grp1">
      <param name="displayRowNumbers">False</param>
      <param name="drilldown">row</param>
      <param name="entityName">results</param>


      <!-- just a simple header. -->
      <module name="SimpleResultsHeader" layoutPanel="panel_row1_col1_grp1">
        <param name="entityName">results</param>
        <param name="headerFormat">$click.fields.EventName$</param>
      </module>

      <module name="ConvertToIntention">
        <param name="intention">
          <param name="name">stringreplace</param>
          <param name="arg">
            <param name="event">
                <param name = "value">$click.fields.EventName$</param>
            </param>
          </param>
        </param>

        <module name="TextField">
            <param name="name">event</param>
            <param name="label">EventName :</param>
            <param name="template">event="$event$"</param>
            <param name="customBehavior">sendContextKeysUpstream</param>
        </module>
      </module>
    </module>
  </module>
 </view>

[sideview · Accepted solution]

Make sure you've read through the documentation. Really spend an hour or two reading through the Sideview Utils documentation starting from the first page and clicking the "next" links to proceed. Note that the first page of Sideview Utils tells you to go carefully read 3 particular "intro" pages in the UI Examples and not to proceed until you have done that. I could be wrong but there are some things in your XML that say to me that you've skipped on to copying-and-pasting from other apps and hoping things will just start working.

To skip to the good news, here is a cleaned up copy below, where the TextField will get populated with the EventName value the user clicks on.

<view template="dashboard.html">
  <module name="SideviewUtils" layoutPanel="appHeader" />
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="Search" layoutPanel="panel_row1_col1" autoRun="true">
    <param name="search">index=TMS | fields sourcetype EventName Count | stats sum(Count) as count by EventName sourcetype | fields sourcetype EventName count 
    | join type=inner EventName [SEARCH index=lookup sourcetype=major_event earliest=-1m@m | fields - sourcetype]  
    | table sourcetype EventName count ATTACK_NAME  | sort - count | APPEND [ search  index=fireeye | rename cef_dvendor as sourcetype | rename cef_name as ATTACK_NAME | rename sname as EventName | stats count by EventName,ATTACK_NAME,sourcetype | sort - count] | table EventName ATTACK_NAME sourcetype count</param>
    <param name="earliest">-4h</param>

    <module name="SimpleResultsTable">
      <param name="displayRowNumbers">False</param>
      <param name="drilldown">row</param>
      <param name="entityName">results</param>

      <!-- Note you'll be happier in the long run using Sideview's 
           HTML module instead of SimpleResultsHeader -->
      <module name="SimpleResultsHeader">
        <param name="entityName">results</param>
        <param name="headerFormat">$click.fields.EventName$</param>
      </module>

      <module name="ValueSetter">
        <param name="name">event</param>
        <param name="value">$click.fields.EventName$</param>

        <module name="TextField">
          <param name="name">event</param>
          <param name="label">EventName :</param>
          <param name="template">event="$event$"</param>
        </module>
      </module>
    </module>
  </module>
</view>

If you want to use the TextField's value in some other search, you'd nest another Search module in there and refer to the value as $event$. Or say you wanted to have a green button next to the TextField and when the user clicks it you want to redirect to some other form search view, you'd have a Redirector module with appropriate params, including <param name="arg.event">$event$</param>. More detail can be found in the Sideview Utils documentation.

[hexx]

Brilliant, as always!