topic Re: Query Regarding using parameter q from URL in the view XML(Advaned XML) in All Apps and Add-ons

Query Regarding using parameter q from URL in the view XML(Advaned XML)

tkadale — Thu, 21 Apr 2011 12:15:37 GMT

I am developing a small application. I have the following situation:
My first view shows a data for all the Users.
After clicking on that view it is redirected to separate view.
On this second view I want to show the data for the single User which
was clicked in First Graph.
I want use value of user which was clicked, from parameter q of URL,
in my drill down view.
I have searched it on Splunk answers.
The solution provided was, Sideview Utils modules.
How to use Sideview utils for this?
Can anybody help me!

Re: Query Regarding using parameter q from URL in the view XML(Advaned XML)

tkadale — Mon, 25 Apr 2011 07:08:34 GMT

For above problem, will the Redirector Module of SideViewUtils be useful?? Can anybody help me how to use it?

Re: Query Regarding using parameter q from URL in the view XML(Advaned XML)

sideview — Fri, 27 May 2011 06:57:38 GMT

It's hard to answer without more specifics, but I would start by reading the documentation in the Sideview Utils app, and view the XML source of the linking examples that it has.

Very quickly, it looks sort of like the following:

But first, you dont want to use the 'q' parameter at all. Actually using the 'q' parameter, or the 's' or 'sid' parameters will activate a bunch of core Splunk UI behavior that will interfere with the correct operation of the URLLoader module. Instead you'll have simple querystring args like '?user=bob'.

In view #1,

 ... 
 <module name="SimpleResultsTable">
   <module name="Redirector">
     <param name="url">second_view</param>
     <!-- $click.fields.user$ will grab the value of the 'user' field, from the table -->
     <param name="arg.user">$click.fields.user$</param>
     <param name="arg.earliest">$search.timeRange.earliest$</param>
     <param name="arg.latest">$search.timeRange.latest$</param>
   </module>
</module>

and in view 2:

<module name="URLLoader">
  <module name="HTML">
    <param name="html"><![CDATA[
      showing events for user=$user$
    ]]></param>
  </module>
  <module name="Search">
     <param name="search">sourcetype=something user=$user$ | (more search language...)</param>
     <module name="EventsViewer"></module>
  </module>
</module>

if you want view #2 to have a TextField or a Pulldown module to prepopulate the value of $user$, you just stitch in a TextField or a Pulldown module, give it <param name="name">user</param>, and nest it inside the URLLoader, and nest the other stuff like Search and SimpleResultsTable, inside it.