All Apps and Add-ons

Multiselect pulldown field value to redirector sideview

disha
Contributor

I am using multiselct pulldown for selecting the VMSids with OR seprator.and I am passing it to next view.I am not sure where I am doiung wrong but the result is not coming correctly as I have tested it on search App and its working fine.May be %20 is causing problem.
Here is my code:
DetailedSIDview:

<![CDATA[
| inputlookup vmssidlist.csv |stats count by VMSID
]]>


VMSID
$name$
30
$value$
+OR+
$value$
left
$name$
dedup $name$ | sort $name$


<![CDATA[


]]>

In ADDSid View


<![CDATA[
|inputlookup vmssidlist.csv |search $VMSID$|table VMSID
]]>


URL the values are passing like:
vmsstb/AddSID?VMSID=000-00426-36321-028%20OR%20000-00426-36413-062%20OR%20000-00426-37896-246

I am believing that it will expand like VMSID=000-00426-36321-028 OR 000-00426-36413-062 OR 000-00426-37896-246
I am stuck Please help.

1 Solution

sideview
SplunkTrust
SplunkTrust

Well the standard way to get a Button that redirects the user to another view would be to just use Button and Redirector like so:

<module name="Button">
  <param name="Add VMSID</param>
  <module name="Redirector">
    <param name="url">AddSID</param>
    <param name="arg.VMSID">$VMSID.rawValue$</param>
  </module>
</module>

The linking docs show some examples of this. Is there a reason this didn't work for you?

Breaking it down, one thing you're doing that you want to think about, is whether to use the straight $VMSID$ key, or $VMSID.rawValue$. As the linking docs talk about, the former is to be used when you want to use the value directly into the search language, and the latter is what you need if/when the value is going to be used to prepopulate another multiselect Pulldown in the target view.

Secondly, you had <param name="template">$value$</param> as your template param. But this means that the individual terms will not be wrapped in "VMSID=". ie $VMSID$ will evaluate to 000-00426-36321-028 OR 000-00426-36413-062 OR 000-00426-37896-246, with no VMSID= parts.

Instead I think you want to do <param name="template">$name$="$value$"</param>

Note that if you do follow this instruction, then in your target page, you'll want to also remove the VMSID= part from your hardcoded search, ie you'll just have

|inputlookup vmssidlist.csv|search $VMSID$|outputlookp vmsadd.csv|table VMSID

because the $VMSID$ key already will now come with its own prefixes and everything.

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

Well the standard way to get a Button that redirects the user to another view would be to just use Button and Redirector like so:

<module name="Button">
  <param name="Add VMSID</param>
  <module name="Redirector">
    <param name="url">AddSID</param>
    <param name="arg.VMSID">$VMSID.rawValue$</param>
  </module>
</module>

The linking docs show some examples of this. Is there a reason this didn't work for you?

Breaking it down, one thing you're doing that you want to think about, is whether to use the straight $VMSID$ key, or $VMSID.rawValue$. As the linking docs talk about, the former is to be used when you want to use the value directly into the search language, and the latter is what you need if/when the value is going to be used to prepopulate another multiselect Pulldown in the target view.

Secondly, you had <param name="template">$value$</param> as your template param. But this means that the individual terms will not be wrapped in "VMSID=". ie $VMSID$ will evaluate to 000-00426-36321-028 OR 000-00426-36413-062 OR 000-00426-37896-246, with no VMSID= parts.

Instead I think you want to do <param name="template">$name$="$value$"</param>

Note that if you do follow this instruction, then in your target page, you'll want to also remove the VMSID= part from your hardcoded search, ie you'll just have

|inputlookup vmssidlist.csv|search $VMSID$|outputlookp vmsadd.csv|table VMSID

because the $VMSID$ key already will now come with its own prefixes and everything.

0 Karma

sideview
SplunkTrust
SplunkTrust

Cool. Well which to use depends on what you're trying to do. Since you want to have the search language version in the URL you want the $VMSID$, including the templating and the separator. If instead you wanted to prepopulate a different multiselect Pulldown in the second view you would use $VMSID.rawValue$. Happy to help.

0 Karma

disha
Contributor

Thankyou. only Thing I have changed is in redirector module I am passing
$VMSID$
because $VMSID.rawValue$ is passing value like
VMSID=000-00426-36259-016&VMSID=000-00426-39553-117&VMSID=000-00606-91773-025 and "OR" getting omitted and result were not correct. $VMSID$ is producing correct results. Thanks again.

0 Karma

disha
Contributor

1.actually I am not using Redirector module on first page. I am just redirecting to the URL on a HTML button click. As
<![CDATA[
< href="AddSID?VMSID=$VMSID$">

]]>



I have not type a with href just to display it as a code. Can we replace this with Redirector module?

2. On the next page I just need to search those VMSID from one lookup table and output it to another lookup table and display it in the table as these new VMSIDs has been added to new table.like 
|inputlookup vmssidlist.csv|search VMSID=$VMSID$|outputlookp vmsadd.csv|table VMSID
Thanks,
Disha
0 Karma

sideview
SplunkTrust
SplunkTrust

I need a little more detail to give a good answer. On the target view are you trying to prepopulate another multiselect pulldown with the passed value, or do you just want to use the value from the URL in a Search? Can you paste the Redirector XML as well from the first view?

0 Karma

disha
Contributor

I am passing the ADDSid?VMSID=$VMSID$ in anchor link tag on button click the page is showing this as link. I am just searching the passing vmsids in cab and displaying them for testing.after that only I can proceed with processing logic.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...