All Apps and Add-ons

Issue with drilldown using Sideview

theouhuios
Motivator

Hello

I am linking multiple views and in doing so facing an issue with sending the arguments properly to the next view.

In the view3 redirector module is given arguments as

<module name="Redirector">
        <param name="url">target_view4</param>
        <param name="arg.host">$click.value$</param>
        <param name="arg.report">timechart span=1hr avg(Value) by host</param>
        <param name="arg.report1">stats avg(Value) as A by host |eval Available Space = A/1024</param>

      </module>

And in view4 the search which I am using is

<module name="Search" layoutPanel="panel_row1_col2" group="Disk Avail" autoRun="True">
        <param name="search">earliest=-24h@h latest=@h sourcetype="Perfmon:*" host=$host$ collection="Memory" counter="Available Kbytes" |$report1$</param>

But the data isn't getting updated in the singlevalue chart which I am using for this. I placed the HTML module to check on why and this is what I see

DEBUGGING: Here are the keys that get passed down through the modules from URLLoader:

host: WTSDDK22

report1: stats avg(Value) as A by host |eval Available Space = A/1024

search: earliest=-24h@h latest=@h sourcetype="Perfmon:*" host=WTSDDK22 collection="PhysicalDisk" counter="% Disk Time"| timechart span=1hr avg(Value) by host

It should be using the report1 argument instead its using the report. I also checked on the URL, the arguments are passing fine.

Any ideas?

-theou

sideview
SplunkTrust
SplunkTrust

Is it possible that either

a) you've edited the view on disk, but forgotten to hit the refresh endpoint to tell Splunkd to reload it from disk? (Use The FreshMaker in Sideview Utils - there's a link under "Key techniques > Tools")

b) Or that there's a version of the view in /local that's overriding the version in default? wherein it's still specifying $report$ instead of $report1$? If anyone ever edited the view through manager it will have created a second copy in local which completely overrides the one in default. Go to manager and view the source of the view and that will always be the one loaded in memory, no matter what directory it was loaded from.

If the arg.* names in the Redirector are matching the querystring arguments in the target page's URL, and the target page has a URLLoader module, and downstream from that URLLoader module there are $foo$ tokens that match those arguments in the URL, that's all you need.

To go further and prepopulate TextField and Pulldown and Checkbox modules from the URL, all you need is to have the "name" param on those modules also match the arguments in the URL.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...