All Apps and Add-ons

Drilldown using Sideview

theouhuios
Motivator

Hello

I am using sideview modules to create charts for the first time so please bear with me.

This is the code below for my first panel.

    <view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">

  <label>linking to other views from tables</label>

  <module name="AccountBar" layoutPanel="appHeader" />

  <module name="AppBar" layoutPanel="appHeader" />

  <module name="SideviewUtils" layoutPanel="appHeader" />



  <module name="Message" layoutPanel="messaging">

    <param name="filter">*</param>

    <param name="maxSize">2</param>

    <param name="clearOnJobDispatch">False</param>

  </module>
  <module name="Search" layoutPanel="panel_row1_col1" group="XYZ" autoRun="True">
        <param name="search">earliest= -4h@h latest=@h sourcetype="IIS:Access:*" serverType="B2C *" OR serverType = "B2B W*" OR serverType = "B2B M*"|dedup serverType| table serverType</param>


                 <module name="JobProgressIndicator"></module>
    <module name="Pager">
        <param name="entityName">results</param>

        <module name="SimpleResultsTable">
          <param name="entityName">results</param>
          <param name="drilldown">row</param>
          <module name="Redirector">
            <param name="url">test2</param>
            <param name="arg.serverType">$click.value$</param>
            <param name="arg.report">stats count by host|fields host</param>
          </module>
        </module>
        <module name="Pager">
          <param name="entityName">results</param>
        </module>
      </module>
    </module>
</view>

And it shows data as

alt text

Now When I click on a serverType I am trying to create a drilldown where it will populate 2 pulldown menus and shows the servers under that servertype. I am able to populate one static pulldown menu on the 2nd view but the one which should be taking the $value$ from the first view click isn't populating and no data is being shown.

<view autoCancelInterval="90" isVisible="False" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <label>Test2</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />


  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>


  <module name="HTML" layoutPanel="viewHeader">
    <param name="html"><![CDATA[
    <h1>Linking - Target view 3</h1>
    ]]></param>
  </module>

  <module name="URLLoader" layoutPanel="panel_row1_col1" autoRun="True">

   <module name="HTML" layoutPanel="viewHeader">
      <param name="html"><![CDATA[
       <h3>$title$</h3>
      ]]></param>
    </module>

    <module name="Pulldown">
      <param name="name">group</param>
      <param name="label">Location</param>
      <param name="staticFieldsToDisplay">
        <list>
          <param name="label">Test</param>
          <param name="value">"Test Center"</param>
        </list>
        <list>
          <param name="label">ISC-E</param>
          <param name="value">"ISC East"</param>
        </list>
        <list>
          <param name="label">ISC-W</param>
          <param name="value">"ISC West"</param>
        </list>
      </param>
      <module name="Search">
        <param name="search">sourcetype="IIS:Access:*" group="$group$" | stats count by serverType | sort serverType</param>
        <param name="earliest">-2h</param>

         <module name="Pulldown">
          <param name="name">serverType</param>      
          <param name="staticFieldsToDisplay">
            <list>
              <param name="label">serverType</param>
              <param name="value">serverType</param>
            </list>
          </param>
      <module name="Search">
            <param name="search">sourcetype="IIS:Access:*" group="$group$" serverType="$serverType$" | $report$</param>
            <param name="earliest">-2h</param>

            <module name="Pager">
              <param name="entityName">results</param>
              <module name="SimpleResultsTable">
                <param name="displayRowNumbers">False</param>
                <param name="entityName">results</param>
              </module>
            </module>


          </module>
        </module>
    </module>
      </module>
    </module>


</view>

Any idea on where am I doing mistake here?

sideview
SplunkTrust
SplunkTrust

UPDATE:

The main problem was that your Pulldown on your second view was configured to have only static options, so there were no dynamic options loading, much less dynamic options being prepopulated. That said the rest of these comments below are also still useful:

ORIGINAL:

Well there's a lot here that's been carried over from the "linking2_tables" example in the Sideview Utils docs.

I can illustrate what you're doing in this code, and maybe that'll help. However it looks like you're only trying to populate one of those two Pulldowns in the target view.

First, this Redirector module will send the user to a URL like "test2?serverType=B2C%20Services&report=stats%20count%20by%20host|fields%20host

<module name="Redirector">
  <param name="url">test2</param>
  <param name="arg.serverType">$click.value$</param>
  <param name="arg.report">stats count by host|fields host</param>

So the URL has two arguments - "serverType" which is the clicked-upon row in the table, and "report", which will will always be that one fixed value. Note that the report value has no $foo$ tokens in it, so that means every redirect will pass the exact same "report" arg.

In the target view then, you do have a Pulldown with the "name" param set to "serverType", so that Pulldown will select itself to the value it sees in the URL (technically this is an interaction between Pulldown and the upstream URLLoader module ). And you do use the "report" argument deeper in the view - you plug it into a Search module via $report$.

However that's it. there's no other argument passed that would prepopulate the static Pulldown that you have in the target view. If you wanted to prepopulate that second Pulldown, you'd need a "group=foo" in the URL, and to get that into the URL, you'd of course need to have a

<param name="arg.group">$click.fields.group$</param>

but of course, there is no field in that Table drilldown called group... So you'd also have to change your search language so that it was showing both serverType and group in each row.

I hope that helps.

Other little notables are as follows:

  • your timeranges dont match up - On the first view you're getting serverType values from the past 4 hours, but on the target view you're only loading the last 2 hours. If the server was present in the data 3 hours ago but not 2 hours ago then it wont be able to populate.

  • you might find it less confusing to use the Sideview convention of $click.fields.serverType$ and $click.fields.someOtherFieldFromTheTable$ instead of the legacy $click.value$ tokens.

  • The easiest way to debug drilldowns is always to throw an HTML module under the table and temporarily remove or comment out the Redirector module. Then in that HTML module you can just print out $click.fields.someField$ and $click.fields.someOtherField$ and debug it more quickly, and not have to squint at weird URL's and use your back button all the time. Then when you have things the way you want it, comment out your HTML module and uncomment the Redirector.

  • If you have the latest Sideview Utils though, there's also a Runtime Debug mode in the Sideview Editor, and while the interface is quite powerful and quite complicated, this can be a useful tool to inspect what $foo$ tokens are, and where they're coming from.

sideview
SplunkTrust
SplunkTrust

That's right. I missed this too on my first reading. You had misconfigured that Pulldown in the second view - it was being told to only have one static option and no dynamic option. Note that if you're on a 2.X version of Sideview Utils you can use the valueField and staticOptions params which are less clunky than the legacy "searchFieldsToDisplay" and "staticFieldsToDisplay" options. Indeed if you just configure that Pulldown to have dynamic values, then it will load them and prepopulate the correct one.

0 Karma

theouhuios
Motivator

Got it. I was using the staticmodule where as I should be doing a searchFields module.But not the worst part would be to connect this 2nd view to the 3rd view where it should list the other stats of this server based on the input given here.

0 Karma

theouhuios
Motivator

During the debugging I do see that the serverType is being passed down but its not get stored.It's changing to $serverType$ immediately and that's why the data is not coming. And an Error comes saying "Pulldown is configured statically but with only a singly static option" .

0 Karma

theouhuios
Motivator


sourcetype="IIS:Access:*" serverType="$serverType$" | $report$
-4h

Shouldn't the serverType which is clicked on the first chart be used as a value? Or I need to put a populatingsearch for the pulldown to be able to populate all serverTypes.

0 Karma

theouhuios
Motivator

I guess I am still doing a mistake here, on the target


sourcetype="IIS:Access:*" | stats count by serverType | sort serverType
-2h

     <module name="Pulldown">
      <param name="name">serverType</param>      
      <param name="staticFieldsToDisplay">
        <list>
          <param name="label">serverType</param>
          <param name="value">$serverType$</param>
        </list>
      </param>
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...