All Apps and Add-ons

Redirector in SimpleResultsTable

gpanicker
Explorer

I am trying to use a Redirector module within a SimpleResults table. The Search which I am using has stats and eval functions.I do not see any fields in the Results table Clickable.
Basically if I click on any eventName , I want to navigate to a new page with the search query for that particular eventName.. But I am not bale to click on anything.. Please Help..





dashboard


Last 60 minutes
True

index=exp sourcetype="expwebtracelog" pageName="Library serverName ="CHESLER" | stats avg(duration) as avgdur,max(duration) as maxdur, p90(duration) as perdur , count as total_count,count(eval(success="false")) as failed_count by pageName,eventName | eval "Success %"=(total_count-failed_count)/total_count*100 | eval "Average Request Duration"=avgdur/1000 | eval "Max Request Duration"=maxdur /1000 |eval "90th Percent"=perdur /1000 | fields - avgdur maxdur perdur | sort pageName,eventName
Libabry transactions


True
False

True
100

https://splunk.sea.corp.expecn.com/en-US/app/search/flashtimeline
index=exp sourcetype="expwebtracelog" pageName="Library serverName ="CHESLER" eventName=$click.name2$
-1h
True







0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

It's a simple problem actually. The SimpleResultsTable module has a "drilldown" param, and if you want it to be clickable, you have to not just put other modules inside it (which makes sense), but you have to also set the "drilldown" param to "row".

I've thought about patching the module from Sideview Utils to make this go away -- ie to make it so that if the module has downstream modules, and drilldown is set to 'none' at load time, set drilldown to 'row' at least. I might do that actually cause this isn't the first time it's come up, and I already patch and normalize all kinds of things on SimpleResultsTable anyway.

Beyond that, here is some unsolicited advice that might help, reading your view:

1) If you're specifying a 'view' name in the "url" param, you can just specify it as "flashtimeline". If you want to explicitly route the user up and over into the search app, I'd use "../search/flashtimeline". The relative URL will work great even if you're going through a proxy, and you wont have that big hardcoded domain name in your XML.

2) This is off the top of my head, but if you're using the legacy "q" arg, I think you might need to have a "search " in front of that search string. I forget though. I never use the old "q" arg, I just link to views that have SideviewUtils in them, which allows you to do "?searchBar=foo&autoRun=True" and thus defeat the entire decomposition/resurrection framework. But that's another story.

3) I think you want to use $click.value$ there, and not $click.name2$.

4) some of the things here were carried over from when you did the conversion from simplified XML -- notably the EnablePreview and JobProgressIndicator modules don't need to contain all those other modules. Each of those can just have their closing tag right there and you can then denest the downstream modules. It doesn't cause any harm to have them nested inside the JobProgressIndicator and the EnablePreview modules, but it serves no purpose and the extra nesting just makes the view crazier. Also 'groupLabel' is a weird simplified XML bug. that should be a group attribute. Or better yet since you're using Sideview Utils already, don't use the group attribute and instead just use an HTML module with a simple HTML header in it.

View solution in original post

sideview
SplunkTrust
SplunkTrust

It's a simple problem actually. The SimpleResultsTable module has a "drilldown" param, and if you want it to be clickable, you have to not just put other modules inside it (which makes sense), but you have to also set the "drilldown" param to "row".

I've thought about patching the module from Sideview Utils to make this go away -- ie to make it so that if the module has downstream modules, and drilldown is set to 'none' at load time, set drilldown to 'row' at least. I might do that actually cause this isn't the first time it's come up, and I already patch and normalize all kinds of things on SimpleResultsTable anyway.

Beyond that, here is some unsolicited advice that might help, reading your view:

1) If you're specifying a 'view' name in the "url" param, you can just specify it as "flashtimeline". If you want to explicitly route the user up and over into the search app, I'd use "../search/flashtimeline". The relative URL will work great even if you're going through a proxy, and you wont have that big hardcoded domain name in your XML.

2) This is off the top of my head, but if you're using the legacy "q" arg, I think you might need to have a "search " in front of that search string. I forget though. I never use the old "q" arg, I just link to views that have SideviewUtils in them, which allows you to do "?searchBar=foo&autoRun=True" and thus defeat the entire decomposition/resurrection framework. But that's another story.

3) I think you want to use $click.value$ there, and not $click.name2$.

4) some of the things here were carried over from when you did the conversion from simplified XML -- notably the EnablePreview and JobProgressIndicator modules don't need to contain all those other modules. Each of those can just have their closing tag right there and you can then denest the downstream modules. It doesn't cause any harm to have them nested inside the JobProgressIndicator and the EnablePreview modules, but it serves no purpose and the extra nesting just makes the view crazier. Also 'groupLabel' is a weird simplified XML bug. that should be a group attribute. Or better yet since you're using Sideview Utils already, don't use the group attribute and instead just use an HTML module with a simple HTML header in it.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...