All Apps and Add-ons

Parameters between Sideview and non-Sideview

cphair
Builder

Is it possible to use Redirector to pass parameters to a non-Sideview view (i.e. one that doesn't have the URLLoader module)? The parameters show up in the target view's URL, but they aren't being used. The target view is in simple XML, and I'd rather not convert it if I don't have to.

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

It's really not possible, no.

However, if I give you the long answer you might feel like it's almost possible. Here goes.

The only way you can pass things to another view in core splunk is by passing a full search string as ?q=foo|timechart count along with earliest/latest, by passing savedsearch name as ?s=foo, or by passing a search id as ?sid=1231241412. Note that in all cases you're really passing an entire single search, and not just a single argument.

When the core XML view receives one of those three arguments, whether it's a simplified view or an advanced XML view, the module system will try to run that search in all of the subtrees of the view. If the view has only one one long, deep, ie super-nested subbranch of modules like the flashtimeline view or the advanced charting view, this generally works. The single search gets 'resurrected' in the target view.

With the simplified xml though, you're generally dealing with more than one chart/table. At best you'll end up with that one search running identically in all panels. At worst things will go very wrong and you'll get error messages and/or very confusing search results.

Hypothetically, if there's only one panel in the simplified XML, it might work. I've never tried. You might try it and take a very close look at whether it's really running the right search. In the end I recommend converting the view to advanced XML because the URLLoader's method is much simpler and more intuitive.

View solution in original post

sideview
SplunkTrust
SplunkTrust

It's really not possible, no.

However, if I give you the long answer you might feel like it's almost possible. Here goes.

The only way you can pass things to another view in core splunk is by passing a full search string as ?q=foo|timechart count along with earliest/latest, by passing savedsearch name as ?s=foo, or by passing a search id as ?sid=1231241412. Note that in all cases you're really passing an entire single search, and not just a single argument.

When the core XML view receives one of those three arguments, whether it's a simplified view or an advanced XML view, the module system will try to run that search in all of the subtrees of the view. If the view has only one one long, deep, ie super-nested subbranch of modules like the flashtimeline view or the advanced charting view, this generally works. The single search gets 'resurrected' in the target view.

With the simplified xml though, you're generally dealing with more than one chart/table. At best you'll end up with that one search running identically in all panels. At worst things will go very wrong and you'll get error messages and/or very confusing search results.

Hypothetically, if there's only one panel in the simplified XML, it might work. I've never tried. You might try it and take a very close look at whether it's really running the right search. In the end I recommend converting the view to advanced XML because the URLLoader's method is much simpler and more intuitive.

sideview
SplunkTrust
SplunkTrust

To back up a second though... Certainly the Redirector module can pass standard "q", "earliest", and "latest" args to views like charting and flashtimeline. So in that sense you can link to non-Sideview target views. It's just in the non-trivial cases where you want to link to a more custom view that it wont work right.

0 Karma

sideview
SplunkTrust
SplunkTrust

After you use $foo$ tokens in the Sideview system, you come to expect the same tokens to work intuitively in core splunk modules, but they really dont. I don't think there's any way to do this I'm afraid. At least not without writing a bunch of custom javascript at the app-level to patch and customize the behavior. Note that the $foo$ tokens, as they appear in HiddenSearch, can only substitute "intentions" called "foo". Whereas with the Search module from Utils, the $foo$ values can pull in any simple token (and you never use intentions at all).

0 Karma

cphair
Builder

Okay, thanks.

Next question: Can I override an intention in the target view? I'm testing with another view that has a stringreplace intention with a default value for the field I'm trying to pass in, and the search contains that $parameter$ explicitly. The search time (which isn't a parameter in the target search) is passed through correctly, but the other field ends up with the target's default value.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...