how to pass value to another view and how to get it

[john]

hi,

I want to pass value form driilldown to another view but its not working .Drill down redirecting to another view but in that view iam not able to get that value iam getting null value in that view. What could be the issue .Please help

this is what i have tried

My table looks like this:

value  id     _time      
abc    1       ...
hij    2
lll    3
000    4

1st view

<module name="HiddenSearch" layoutPanel="panel_row3_col1"  autoRun="True">
  <param name="search"><![CDATA[|search source="C:\\.\\..." |rex field=_raw "Id\s(?<Value>.*)\:\s"|table value,_time]]></param>    
  <module name="Paginator">
    <param name="entityName">events</param>
    <param name="maxPages">10</param>
    <param name="count">5</param>
    <module name="ResultsHeader">
      <param name="entityName">scanned</param>
      <param name="entityLabel">Events</param>
      <module name="SimpleResultsTable">
        <param name="count">100</param>
        <param name="displayMenu">True</param>
        <param name="drilldown">row</param>
        <param name="drilldownPrefix">click</param>
        <module name="ConvertToIntention">
          <param name="settingToConvert">errors_setting</param>
          <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
              <param name="errors">
                 <param name="value">$click.value$</param>
              </param>
            </param>
          </param>
          <module name="ViewRedirector">
            <param name="viewTarget">Sample_View</param>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

Sample_View

<view autoCancelInterval="90"  template="dashboard.html">
  <label>kl Dashboard</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="HiddenSearch"  layoutPanel="panel_row1_col1">
    <param name="search"> <![CDATA[|search source="C:\\...."  $click.value$| stats count as "Count" ]]>  </param>
    <module name="SingleValue">
      <param name="field">Count</param>
      <param name="afterLabel"> error</param>
    </module>
  </module>
</view>

iam trying to get the value which is coming under value and have written a serch on that in another view.

[sideview]

If you're interested in giving yourself an easier way to do this, as well as to do many other things, you should check out Sideview Utils.

The 1.3.X version of Sideview Utils is available from Splunkbase under an LGPL license.

Then the 2.0 version of Sideview Utils is out, and although 2.0 is newer, better, and although you can get a 90 day trial from the Sideview Site, note that it's not a free product and it'll stop working after 90 days.

Anyway, with either the older or the new versions, this has been in Sideview Utils for a while and you can greatly simplify linking from page to page as follows:

Here's what your XML would look like if you switched. Note Search, HTML, Pager, Redirector and URLLoader are all Sideview modules that get loaded from Utils and that just fit in as available modules right along the core modules.

<module name="Search" layoutPanel="panel_row3_col1"  autoRun="True">
  <param name="search"><![CDATA[|search source="C:\\.\\..." |rex field=_raw "Id\s(?<Value>.*)\:\s"|table value,_time]]></param>    
  <module name="HTML">
    <param name="search"><![CDATA[
      $results.scanCount$ events $search.timeRange.label$
    ]]</param>
  </module>
  <module name="Pager">
    <param name="entityName">events</param>
    <param name="maxPages">10</param>
    <param name="count">5</param>
    <module name="SimpleResultsTable">
      <param name="drilldown">row</param>
      <module name="Redirector">
        <param name="url">nameOfMyTargetView</param>
        <param name="arg.myPassedValue">$click.value$</param>
      </module>
    </module>
  </module>
</module>

Then, if say the user clicks on a row where $click.value$ is "fred", the table clicks then send the user to `nameOfMyTargetView?myPassedValue=fred.

And the target view would just look like this. (Note that I've taken the liberty of replacing your SingleValue modules with simple HTML. If you don't like rolling your own CSS and customizing the look and feel, you may prefer to keep using SingleValue though).

<module name="URLLoader">
  <module name="Search">
    <param name="search"> <![CDATA[|search source="C:\\...."  $myPassedValue$| stats count as "Count" ]]>  </param>
    <module name="HTML">
    <param name="search"><![CDATA[
      $results[0].Count$
    ]]</param>
  </module>
</module>

Note that TONS more information, documentation and examples are available inside Sideview Utils.

[araitz]

You almost had it!

Keep in mind that you are passing a 'search string' (rather than a 'context', which contains things like 'click.value' and the intention to be string-replaced) to the second view. Therefore, you need to get the full search string in the first view before you pass it on to the second view.

Try something like this below the SimpleResultsTable in the first view:

<module name="HiddenSearch">
  <param name="search"><![CDATA[source="C:\\...."  $token$| stats count as "Count" ]]>
  <module name="ConvertToIntention">
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="token">
           <param name="value">$click.value$</param>
        </param>
      </param>
    </param>
    <module name="ViewRedirector">
      <param name="viewTarget">Sample_View</param>
    </module>
  </module>
</module>

The second view will receive the search string with the replacement already done, and will use this explicit search string in the view. Thus, you shouldn't need the HiddenSearch in the second view unless you intend on also using this same view in non-drilldown scenarios.

[john]

Thanks nick.

[sideview]

Nope, in core splunk you can pass only one search and one timerange, rather than being able to pass 1-N general arguments. As far as I know everyone who needs to do this ends up downloading utils.

[john]

Hi can v pass more than one hidden search to another view like count,Then chart, because that can also work for me.because i have tried to pass two seraches to the other view but it was not working

[sideview]

In Sideview Utils this is pretty easy -- you just have more than one subtree of modules in the target view, and you apply the $myPassedValue$ token however you want in each. With core Splunk it can be done, but it requires writing a fair bit of custom javascript. You can see for instance in the Deployment Monitor app I think there's a "forwarder detail" view in which the name of a splunk forwarder is passed, and then in that view, that forwarder name is applied to run more than one search and render different charts/tables/etc..

[john]

I have tried this but i want to do searches in second view using the particular value which is getting from first view.i dont want to use that value in the first view and passing the result to another view.Using that value i want create dashboard having chart and other searches also in second view.

[john]

actually i want the value which user clicked in drilldown to another view so that to write different searches on that particular value.Not simply showing the count alone but dashboard for other searches also.