topic Re: Custom Results View in Dashboards & Visualizations

Custom Results View

MatthewTowey — Thu, 17 May 2012 09:33:16 GMT

When I search for a result I want to be able to select a single result and view it in a custom view i.e I search for "blank" and get 100 results. When I select a result from the results table I see a view with only the result I selected and information about this result.

Just wondering if this is possible using the advanced XML as I have never had to use XML before, any help or questions to explain the request more are welcomed

Thanks in advance
Mat

Re: Custom Results View

araitz — Mon, 28 Sep 2020 11:50:22 GMT

Yes, absolutely possible. This is off the top of my head, so excuse any typos or errors

Your View

*
False
1

dashboard


index=_internal | timechart count by source
-1h

results

row


index=_internal


addterm

$click.value$



flashtimeline

This post has more information on the ConvertToIntention module:

http://splunk-base.splunk.com/answers/41366/drilldown-clickvalue-isnt-being-replaced

Re: Custom Results View

MatthewTowey — Fri, 18 May 2012 14:31:49 GMT

Hi araitz
Thanks for the response
Sorry for my complete beginner experience but your going to have to hold my hand a little here does this code that you have written go into it's own xml file in $Splunk\etc\apps<my app>\default\data\ui\views and then do I reference it in the $Splunk\etc\apps\Matt\default\data\ui\nav default.xml ???

Re: Custom Results View

araitz — Mon, 21 May 2012 15:29:16 GMT

Yes, take the code above and put it in a new view, either through Manager > User Interface > Views > New or by pasting it in to a file in $SPLUNK_HOME/etc/apps/<your_app>/default/data/ui/views/. If you put a reference to it in $SPLUNK_HOME/etc/apps/<your_app>/default/data/ui/nav/default.xml, it will show up in the nav bar.

Re: Custom Results View

sideview — Mon, 21 May 2012 17:40:39 GMT

You may want to check out Sideview Utils. You can either get the older 1.3 version free from Splunkbase, or get a 90 day trial of the new 2.0 version from the Sideview site.

As for what the benefit is here for this use case, the short short version is that it's a lot more intuitive. a) you wont have to use intentions, or think about intentions, and b) you can use the Redirector module to pass the clicked value from the first view to the second view, and you can use that $myClickedUponRowValue$ token in the second view however you want.

For the long version, I'd pull down the app, either the newer or the older version, and then open the app in your browser. You'll see it has tons of documentation and examples. You should read through all of it, but there are several pages about these areas -- linking from view to view, prepopulating UI elements in the target view, and using the Redirector and URLLoader modules.