All Apps and Add-ons

2 Multiselect Pulldown with "->" and "<-" button splunk sideview

disha
Contributor

I am not sure if we can do like this in splunk sideview.
I have a search
sourcetype="myagent" |spath path="SID" output="CustomerID"|stats count by CustomerID

CustomerID
$name$
$value$
left
$name$
+OR+
$value$
4
dedup $name$ | sort $name$
...
This is a multiselect pulldown. My requirement is to add 2 multi-select pulldowns on left and right. In the middle we need 2 buttons - one with "->" and other with "<-" pictures.
So that user can select/deselect the CustomerIDs.
Please Suggest.
Thanks

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

Well, the control you describe, including both the boxes as well as the two buttons, is generally thought of a single large UI control (the official name afaik is "transfer box").

I think you'd have a hard time trying to turn a pair of Multiselect Pulldowns into a transfer box. For one thing, one of them would have to be upstream from the other, and if there's one thing the Splunk module framework really doesn't like, it's communication upstream... Technically I could do it with some customBehaviors, but these roads are fraught with much peril.

the good news is that transfer boxes can often can be replaced with something else. What springs to mind for me is the Sideview Filters module. this is a lesser-known module that essentially maintains a little list of active filters, like "user=mildred" or "bytes>100" or "status!=200", and the active filters at any one time comprise a little unordered breadcrumb.

The Filters module needs to be wired up with a CustomBehavior (one reason why it's as-yet undocumented), but you can see an example of it in the Sideview Explore interface, which is one of the advanced sample interfaces that ships with Sideview Utils 2.X. What you'll see is that the explore interface allows the user to pick an individual key and value on which to filter, and then click a little 'add' button to add the selected key-value pair to the list of active filters... Since Filters module always requires a customBehavior for the downstream part, you'd have to study the application.js in Sideview Utils to see how it works.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Well, the control you describe, including both the boxes as well as the two buttons, is generally thought of a single large UI control (the official name afaik is "transfer box").

I think you'd have a hard time trying to turn a pair of Multiselect Pulldowns into a transfer box. For one thing, one of them would have to be upstream from the other, and if there's one thing the Splunk module framework really doesn't like, it's communication upstream... Technically I could do it with some customBehaviors, but these roads are fraught with much peril.

the good news is that transfer boxes can often can be replaced with something else. What springs to mind for me is the Sideview Filters module. this is a lesser-known module that essentially maintains a little list of active filters, like "user=mildred" or "bytes>100" or "status!=200", and the active filters at any one time comprise a little unordered breadcrumb.

The Filters module needs to be wired up with a CustomBehavior (one reason why it's as-yet undocumented), but you can see an example of it in the Sideview Explore interface, which is one of the advanced sample interfaces that ships with Sideview Utils 2.X. What you'll see is that the explore interface allows the user to pick an individual key and value on which to filter, and then click a little 'add' button to add the selected key-value pair to the list of active filters... Since Filters module always requires a customBehavior for the downstream part, you'd have to study the application.js in Sideview Utils to see how it works.

disha
Contributor

Thanks Nick for the reply. I am glad that this query was in back of your mind and answered. Looking into application.js and Working on it.
Thanks,
Disha

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...