Dropdown Select in a Simple Results table

[spencerbrett]

I am generating a table of errors, and I would like to add the functionality of having a dropdown select with predefined fields in the simple results table. This would allow me to save a value for the field and attribute it to that result. Currently, I have to click on the result and go to a separate page to save the field value from a drop down menu.

Is there any way to include this in the table?

[spencerbrett]

Pulldown Table Test

[spencerbrett]

Ah I see how that can get expensive. We decided to just simplify it by making a column that displays the current cause and a separate pulldown column for running the save drilldown. Thank you so much for your help.

[sideview]

Yep. You can embed PostProcess modules along with ResultsValueSetter modules in there, and there will be one of them for each row, and then you can carve up the current search result with postProcess, get a single row that has the relevant field(s) for just that row, then use ResultsValueSetter to "pull down" the field value and turn it into a $foo$ token. If it matches the Pulldown name, the Pulldown will prepopulate to that.

You can embed Search instead of PostProcess but this will actualy dispatch 10 or 20 searches which is generally not a good direction, even with inputlookup.

[spencerbrett]

Also, I'm looking into using the ResultsValueSetter module to prepopulate the Pulldown with the current value, but I also need static options.

Basically, each result has a "cause" field that needs to be manually set if it doesn't yet have a value. If it does have a value, I want the Pulldown to display that value in the table instead of the default blank.

To clarify, can I use the ResultsValueSetter to choose the value for each result in the table that matches from my Pulldown's staticOptions list to display in the Table?

[spencerbrett]

That's a very good working solution. Is it possible to do it without the button? When they select an option from the pulldown it fires off a search on that click. Is that possible?

[sideview]

you're almost there. Put the Button module downstream from the embedded Pulldown and then the Search module downstream from that, then you refer to the field values from the table row just as $row.fields.fieldName$ in your search, and you're there.

[spencerbrett]

Thank you! I can't believe I missed that example. The embedding worked exactly how I wanted it to, now I just need it to fire off a drilldown only when I select an option from the pulldown.

[sideview]

I'll get around to posting a full answer, but in the meantime there are pretty extensive docs on the Table module's embedding feature in Sideview Utils. See under "Module Documentation > The Table Module > Table - Embedding Examples".

You basically will embed all of that config, with the Pulldown and the Button and the Search into the table row. Go ahead and give it a shot on your own because it'll take me a few days before I can circle back to this.

[spencerbrett]

I think I might try a js solution to this to make my own table. Unless I can find a definitive way to embed the Pulldown module in the Table module with Sideview Utils.

[spencerbrett]

It is keeping a look up. This is the XML for the save on the details page.

[sideview]

Can you give me some details about how the second view is saving the pulldown value associated with each row value? Is it keeping a lookup? Can we fill in these things with a few more nouns to make it easier to follow?

[spencerbrett]

Exactly, I want to embed the Pulldown module into the Table module, and drilldown from the selected option in a single view.
I was not the one who built the original views. I've only been working with splunk for the past week.
I do have the latest version of Sideview Utils, and I have read through the 44 pages of documentation. I am still somewhat unclear about how to use it, but I have a brief understanding of the core concepts.

[sideview]

So you've already made a couple custom views in the advanced XML, and they're working, but you want to rebuild them as a single view basically? First, was it you that built the original views?
Secondly, this is possible with Sideview Utils, and probably without using any custom code, however it will be pretty advanced stuff. Are you using latest Sideview Utils already? You'll need the 2.X version for the Table Embedding feature, whereby we'll get the Pulldown modules embedded into the Table. http://sideviewapps.com/apps/sideview-utils

[spencerbrett]

Basically, I have a table of errors with fields including a category name, time frame, cause, and a few other very specific attributes. Currently, I have to click on the table entry and go to a new page to save the "Cause" of the error from a predefined type. I'd like to specify a list of causes of the errors and be able to select the cause from a dropdown at each entry of the table and then save the whole table possibly.

[twistedsixty4]

this is a little vague, could you give an example? maybe with your desired search string? off the top of my head i would just say starting looking at sideview utils, but with more information i could help.