topic Re: drilldown from a hidden column in All Apps and Add-ons

drilldown from a hidden column

kkalmbach — Thu, 23 Jun 2011 21:32:15 GMT

In a dashboard, I have a SimpleResultsTable with a drilldown that uses:

<module name="SimpleResultsTable">                                            
  <param name="drilldown">row</param>
  <module name="Redirector">
         <param name="url">next_page</param>
         <param name="arg.key">$click.fields.key$</param>
  </module>
...

In this case "key" is a unique key that will determine the next_page's search.

The problem is that I would like key to not display in the results table (just be available for the drilldown). The value of "key" is not anything a user should ever see.

Is there anyway to add that field to the table but hide the column, or anything else that will make this possible.

Thanks

-Kevin

Re: drilldown from a hidden column

ziegfried — Fri, 24 Jun 2011 15:22:47 GMT

Editor's note: please see next answer down for modern, Splunk 6.x+ method of doing this

When drilldown is set to row, the module uses the value in the first column of each row as drilldown value. So you can put the field you want to hide in the first column and then hide it using some Javascript in application.js.

Example:

if(Splunk.util.getCurrentView() == "myview") {
    Splunk.Module.SimpleResultsTable = $.klass(Splunk.Module.SimpleResultsTable, {
        renderResults: function($super,data) {
            $super(data);
            $('td:nth-child(2),th:nth-child(2)', this.container).hide();
        }
    });
}

Re: drilldown from a hidden column

sideview — Fri, 24 Jun 2011 20:23:31 GMT

Your first sentence is technically not true if you're using Sideview Utils. Using the $click.fields.fieldName$ syntax you can get the value for any field in the entire row. You're no longer limited to just the first field. Conversely, within core Splunk UI, the "first column" limitation absolutely applies.

Re: drilldown from a hidden column

ziegfried — Sun, 26 Jun 2011 09:42:14 GMT

Ah ok, I wasn't aware of this. Great enhancement btw 😉

Re: drilldown from a hidden column

lanying — Tue, 06 Sep 2011 08:18:32 GMT

Hi.
I have a same problem. So, I'm now apply the application.js and solve the problem. But field's name is not hide.
If the table have 4 fields - first field is hidden , 4 fields name , 3 data fields ard displayed.
Do you understand my question?

Re: drilldown from a hidden column

hexx — Sat, 03 Dec 2011 10:00:29 GMT

Very cool, just threw this into a couple of Splunk on Splunk views!

Re: drilldown from a hidden column

sideview — Fri, 04 Jan 2013 20:14:47 GMT

If you're using a recent version of Sideview Utils, you can use the Table module instead of Splunk's SimpleResultsTable module.

This get you a couple big benefits. First of all, at least for you, is that it has a "hiddenFields" param, which you can use to have field values present in the data, available for drilldowns, but not actually rendered in the table columns.

Secondly, you can use $row.fields.myFieldName$ and $row.fields.someOtherFieldName$ to refer to the field values in the given selected row.

Note that it's "row" instead of SimpleResultsTable's "click". There's a good reason for this name change and it'll make more sense as you use the Table module more. You can always change it away from "row" if you like just by setting the Table module's optional "name" param.

There are several pages of documentation within the Sideview Utils app itself that will tell you all you need to know about the Table module and how to use it.

1) Download the latest version of Sideview Utils (2.2.10) from the Sideview site at http://sideviewapps.com/apps/sideview-utils. Note that if you think you have the app already you probably have the old version from Splunkbase (1.3.5).

2) Install the app, navigate to it and then navigate to "Module Documentation > The Table Module" and go from there. There are several pages and the hiddenFields stuff is pretty early on.

Re: drilldown from a hidden column

Jason — Tue, 16 Dec 2014 17:05:43 GMT

If you are using Splunk 6.0+, with its redesigned UI, it is more simple to do a drilldown based on a hidden column.

In the SimpleXML dashboard, specify which fields should be displayed in the table as such:

Splunk 6.0-6.4.x

<option name="fields">field1,field2,field4,count</option>

Splunk 6.5+

<fields>field1,field2,field4,count</fields>

The other fields, including field3 (output by the search but not listed in the option above) will still be available to the drilldown as $row.field3$ .

Re: drilldown from a hidden column

cwb2 — Thu, 04 Feb 2016 20:52:01 GMT

This worked great for me. Thanks!

Re: drilldown from a hidden column

Jodge — Tue, 22 Nov 2016 10:50:01 GMT

As of Splunk 6.5 the option "fields" has been deprecated.

So, instead now it is just:

<fields>field1,field2,field4,count</fields>

And exactly as before field3 will still be available to the drilldown as $row.field3$ .

Re: drilldown from a hidden column

Jason — Tue, 22 Nov 2016 11:03:52 GMT

Yes, thanks, just noticed that - though <option name="fields"> still works, it will be flagged as deprecated by the nice new xml editor. Updated post.

Re: drilldown from a hidden column

samuelmah — Fri, 21 Jul 2017 08:51:24 GMT

Is there anyway for "fields" to take a variable? I want to be able to show/hide columns from a user option.

*somehow when I specify fields with "<" and ">" it gets removed from the comments. :s

Re: drilldown from a hidden column

pamcarvalho — Tue, 17 Oct 2017 13:51:22 GMT

Hey! I was wondering if this still works, I really need to drilldown values from a hidden field and not sure how to do so

Re: drilldown from a hidden column

Jason — Tue, 17 Oct 2017 15:48:11 GMT

See my answer above, and the comments beneath it.

Re: drilldown from a hidden column

santosh_sshanbh — Thu, 06 Feb 2020 13:48:10 GMT

This helped me to hide a column from a table