All Apps and Add-ons

App Context: How to change the header and replace pulldown for lookup updater Sideview page?

hyahmadi
Explorer

hello splunkers,
I have the xml code for the lookup updater sideview but I just want to change the header of the page (remove the pulldown for search/application and search/lookup file in order to work directly on my app and my lookup updater)how to change parametre to do that?(replace pulldown)
thanks

sideview
SplunkTrust
SplunkTrust

In order to not disrupt any other logic on the page, the best thing to do is to replace the two Pulldowns and their searches with a ValueSetter.

More precisely, delete these lines:

<module name="Search">
  <param name="search">| splunkentity apps/local | table name</param>

  <module name="Pulldown" layoutPanel="mainSearchControls">
    <param name="name">app</param>
    <param name="label">App:</param>
    <param name="valueField">name</param>
    <param name="staticOptions"></param>

    <module name="Search">
      <param name="search">| splunkentity data/lookup-table-files app="$app$" | table name</param>

      <module name="Pulldown">
        <param name="name">lookupName</param>
        <param name="label">Lookup Name:</param>
        <param name="valueField">name</param>
        <param name="staticOptions"></param>

and replace them with this single ValueSetter module.

<module name="ValueSetter">
  <param name="arg.app">YOUR_APP_NAME_HERE</param>
  <param name="arg.lookupName">YOUR_LOOKUP_NAME_HERE</param>

Another approach you might have tried (but that I think would have failed) is to go hardcode the tokens in the searches. However some customBehaviors are operating on this page, and those things will need the app and lookupName tokens to be there.

0 Karma

somesoni2
Revered Legend

Follow the steps from below post to set the current App context and then you can remove the App dropdown (and update lookup table query to use variable for current app context).

http://answers.splunk.com/answers/25153/determine-the-current-app

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...