All Apps and Add-ons

Issue with drilldown using Sideview

theouhuios
Motivator

Hello

I am linking multiple views and in doing so facing an issue with sending the arguments properly to the next view.

In the view3 redirector module is given arguments as

<module name="Redirector">
        <param name="url">target_view4</param>
        <param name="arg.host">$click.value$</param>
        <param name="arg.report">timechart span=1hr avg(Value) by host</param>
        <param name="arg.report1">stats avg(Value) as A by host |eval Available Space = A/1024</param>

      </module>

And in view4 the search which I am using is

<module name="Search" layoutPanel="panel_row1_col2" group="Disk Avail" autoRun="True">
        <param name="search">earliest=-24h@h latest=@h sourcetype="Perfmon:*" host=$host$ collection="Memory" counter="Available Kbytes" |$report1$</param>

But the data isn't getting updated in the singlevalue chart which I am using for this. I placed the HTML module to check on why and this is what I see

DEBUGGING: Here are the keys that get passed down through the modules from URLLoader:

host: WTSDDK22

report1: stats avg(Value) as A by host |eval Available Space = A/1024

search: earliest=-24h@h latest=@h sourcetype="Perfmon:*" host=WTSDDK22 collection="PhysicalDisk" counter="% Disk Time"| timechart span=1hr avg(Value) by host

It should be using the report1 argument instead its using the report. I also checked on the URL, the arguments are passing fine.

Any ideas?

-theou

sideview
SplunkTrust
SplunkTrust

Is it possible that either

a) you've edited the view on disk, but forgotten to hit the refresh endpoint to tell Splunkd to reload it from disk? (Use The FreshMaker in Sideview Utils - there's a link under "Key techniques > Tools")

b) Or that there's a version of the view in /local that's overriding the version in default? wherein it's still specifying $report$ instead of $report1$? If anyone ever edited the view through manager it will have created a second copy in local which completely overrides the one in default. Go to manager and view the source of the view and that will always be the one loaded in memory, no matter what directory it was loaded from.

If the arg.* names in the Redirector are matching the querystring arguments in the target page's URL, and the target page has a URLLoader module, and downstream from that URLLoader module there are $foo$ tokens that match those arguments in the URL, that's all you need.

To go further and prepopulate TextField and Pulldown and Checkbox modules from the URL, all you need is to have the "name" param on those modules also match the arguments in the URL.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...