Sideview Utils and Nested Searches

[steve]

I am trying to nest search modules using Sideview Utils such that a second search is based on data in the first.

For example, the first search returns a list of IP addresses, and the second conducts a search on one of the IP addresses returned by the first search.

When I load the view, the second search runs immediately, without waiting for input from the first.

If I change the second module to a HTML module, and use the results from the first search in the HTML, it works as expected.

Any ideas?

[steve]

I didn't have the ResultsValueSetter. Added it in and it worked great. Thanks!

[sideview · Accepted solution]

You should make sure you don't have two autoRun="True" attributes in your view. You never want to have an autoRun="True" on a module that's nested inside any other module that also has an autoRun="True", because things like this can happen.

I'm not certain whether that's your issue, but whether it is or not here's an example of how to use the Sideview module ResultsValueSetter to pull down values from search 1, and plug them into search 2. Hopefully the example will help.

First, you could of course use a subsearch to do this in one search. However there can be good reasons for doing it this way instead of the subsearch way.

a) If you use subsearches you're then subject to some limits around subsearches - limits in how long subsearches might take to run and limits in the number of result rows they're allowed to return.

b) With subsearches you lose the opportunity for your UI to easily display supplemental detail and even chartable information from that first search, "search 1".

Anyway, here's the example. You'll need to install the Sideview Utils app from the sideview site for this to work. ( http://sideviewapps.com/apps/sideview-utils/ )

<view onunloadCancelJobs="true" template="dashboard.html">
  <label>Using ResultsValueSetter to plug values from one search into another search</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">index=_internal source=*metrics.log sourcetype=splunkd component=metrics group=per_sourcetype_thruput | stats max(eps) as eps by series | sort - eps | head 1</param>
    <param name="earliest">-6h</param>

    <module name="JobProgressIndicator"></module>

     <module name="HTML">
      <param name="html"><![CDATA[
        The HTML module has it's own way of getting field values. For example the sourcetype with the highest eps in the last 6 hours is <b>$results[0].series$</b> with <b>$results[0].eps$</b> as it's highest eps value. <br>
        <br>
        Now lets use ResultsValueSetter to get the same values in a more powerful way.
      ]]></param>
    </module>

    <!-- the ResultsValueSetter module on the other hand gets the field values,
    pulls them down to the client, and makes them available as $fieldName$ 
    tokens to all downstream modules -->
    <module name="ResultsValueSetter" layoutPanel="panel_row2_col1">
      <param name="fields">series,eps</param>

      <module name="HTML">
        <param name="html"><![CDATA[
          Now that we're downstream of the ResultsValueSetter, we can just get the series values like so: <br>
          <br>
          <b>$series$</b><br>
          <b>$eps$</b><br>
          <br>
          And we can just as easily plug one or both of those values into a second Search, like you see below.
        ]]></param>
      </module>

      <module name="Search" layoutPanel="panel_row3_col1">
        <param name="search">index=* OR index=_* sourcetype=$series$ | timechart count</param>

        <module name="HTML">
          <param name="html"><![CDATA[
            Our second search is<br>
            <b>$search$</b><br>
            and we're going to render it into a FlashChart.
          ]]></param>
        </module>

        <module name="FlashChart"></module>

      </module>
    </module>
  </module>
</view>

[sideview]

Can you post the XML? You should be careful to have only one autoRun="True", and have it up at the top of the view on your first Search module. In between the two Search modules you'll have a ResultsValueSetter to pull down the desired field values to be plugged into the second Search.