sideview table drilldown to filter its own postProcess

[sbsbb]

In order being able to filter my results with postProcess, I have first my search going into my pulldowns, that are used from my postprocess (that takes the value from the pulldowns to filter search-results), and after that results from the postprocess are displayed to the table.
So

search
|
Pulldown(s)
|
postProcess (that filter search according to selected pulldowns)
|
table

I the a way to make a drilldown on table to update the postprocess ? : I want the user being able to click on a cell, and that cell becoming added as "field=value" it the postProcess , or even being displayed als filter_tag like on the top of the "sideview Explorer"

But because of the vertical Structur of the gui code, I'm don't know how to go back from table to postProcess... is there a trick ?

[sideview · Accepted solution]

Indeed, the way that the Advanced XML works, with changes always picked up and propagated "downstream", makes this particular kind of interaction seem hard or impossible.

Restating in a different way - although table clicks generally seem to affect things below the table in the page, or to redirect to another page entirely, this is a case where you want the table click to affect.... basically the table itself. Which means you want the Table click to reach "upstream", add the relevant arguments from the click to the same search or postprocess (in this case postprocess) that rendered the Table, and rerender. Along the way obviously you need some indication to the user so they can know what happened, so they can keep track of the various click arguments.

Generally, there are two ways to do this.

1) Think about it differently, and make the Redirector click actually go to a "#user=mildred" URL. Note the "#". The browser will update the URL in the location bar but it's not really a URL in that the page will not reload. However if you have a Sideview URLLoader module upstream it will react to the modified arguments and populate form elements and HTML modules using them. It's still a confusing business but I recommend playing with it a little because it might work for you. What it doesn't really help you with directly is the "displaying a breadcrumb to the user" part. An HTML module can do this in principle but you'll still lack nice "x" icons to make the given filter go away, etc... Give yourself an inch and you'll want a mile.

2) Thus the best answer is really the Sideview Filters module. Filters has been out for a long time and used in some apps but it has never been publicly documented. Also it's designed to work with a custombehavior sitting under the Table/Chart module. So this is a Sideview module only for that rare Sideview Utils user that is comfortable with writing customBehaviors.

To study the approach, you can put this config into a dashboard:

<module name="Search" layoutPanel="panel_row2_col1" autoRun="True">
  <param name="search">index=_ OR index=* | head 10000 | top sourcetype</param>

  <module name="JobProgressIndicator" />
  <module name="Filters">
    <module name="PostProcess">
      <param name="search">search $filters$</param>
      <module name="Pager">
        <module name="Table">
          <module name="CustomBehavior">
            <param name="customBehavior">bounceUpToFilter</param>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

and this customBehavior definition into your application.js

if (typeof(Sideview)!="undefined") {

    Sideview.utils.declareCustomBehavior("bounceUpToFilter", function(module) {
        module.onContextChange = function() {
            var context = this.getContext();
            var xField = context.get("click.name");
            var upwardContext = new Splunk.Context();

            var currentFilters = JSON.parse(context.get("filters.json") || "[]");

            if (xField=="_time") {
                var search = new Splunk.Search("*");
                search.setTimeRange(context.get("search").getTimeRange());
                upwardContext.set("search",search);
            } 

            var clickFilters = JSON.parse(context.get("row.filters") || "[]");
            currentFilters = currentFilters.concat(clickFilters);
            upwardContext.set("filters", JSON.stringify(currentFilters));

            this.passContextToParent(upwardContext);
        }
    });
}

Filters module actually has two different mechanisms it can use to accept things from downstream. This customBehavior uses only the 'applyContext' mechanism. I will try to write some docs to discuss the Filters module. Despite being a pretty advanced thing, and requiring a customBehavior, it's a very powerful interface tool for the more advanced app developers out there.

Anyway, what this example does, is that when you click a row in the Table, it kind of bounces the 'sourcetype=foo' term up from the Table, and it gets caught by the Filters module and displayed as one item in a little unordered breadcrumb. You get little "x" icons to clear the given filter, and there's a lot of hooks and keys and bits and bobs for the app developer that I won't go into. the example as written is a little trivial because clicking the Table causes the postprocess search to change such that only the clicked-upon row will be there when the Table re-renders. Assuming you can get by in the JS, you should get the idea though and be able to adopt this.

[sideview]

Sideview Utils 2.4.8 just released, in which you will find official documentation and working examples of the Filters module. http://sideviewapps.com/apps/sideview-utils