Can I use the redirector module to open a different url/view based on where a user clicks in the SimpleResultsTable?

[0waste_splunk]

Hi,

I have a dashboard which show's results in a SimpleResultsTable. I have set up a drilldown param to all in SimpleResultsTable. My Output will look like as follow:

A B C

x y z
1 2 3

Now what I want is if a user clicks on x, then it should open a url, and if a user clicks on y, then it should open some other url or view. I know how to pass x or y using $row.filed.value$, but I want a different url or view based on the column where the user clicks.

Any help or ideas are appreciated.

FYI: Currently, I am just able to use only one view or column where I can pass the clicked value.

Thanks

[sideview · Accepted solution]

I recommend taking a step back and looking at Table Embedding to solve this problem.

Here is a simple config that adds two columns to a Table. In each column is a link, and by clicking the links the user can either search a particular field value in Google, or in Bing.

<module name="Search" autoRun="True" layoutPanel="panel_row1_col1">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group="per_sourcetype_thruput" | rename series as sourcetype | table sourcetype | fillnull google bing value="value not used"
  ]]></param>

  <module name="Pager">

    <module name="Table">

      <module name="HTML" group="row.fields.google">
        <param name="html"><![CDATA[
          <a href="http://google.com?q=$row.fields.sourcetype$">Google it</a>
        ]]></param>
      </module>

      <module name="HTML" group="row.fields.bing">
        <param name="html"><![CDATA[
          <a href="http://www.bing.com/search?q=$row.fields.sourcetype$">Bing it</a>
        ]]></param>
      </module>

    </module>
  </module>
</module>

But looking at this, you'll probably wonder "why are there two columns at all. If we can render arbitrary html and links, why don't we just put both the link tags into the same table cell? So here's a version that does exactly that:

<module name="Search" autoRun="True" layoutPanel="panel_row1_col1">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group="per_sourcetype_thruput" | rename series as sourcetype | table sourcetype | fillnull search value="value not used"
  ]]></param>

  <module name="Pager">

    <module name="Table">

      <module name="HTML" group="row.fields.search">
        <param name="html"><![CDATA[
          <a href="http://google.com?q=$row.fields.sourcetype$">Google it</a>  

          <a href="http://www.bing.com/search?q=$row.fields.sourcetype$">Bing it</a>
        ]]></param>
      </module>

    </module>
  </module>
</module>

Table Embedding is extremely powerful and flexible, and like almost all the features in Sideview Utils, it has it's own docs page with working examples, inside the Sideview Utils app itself.

remember to always get the real Sideview Utils from the Sideview website rather than the very old version on apps.splunk.com.

---

Another way that people sometimes try is to hack together a solution with the legacy SimpleResultsTable module but I do not recommend this. For the record though, you could use SimpleResultsTable module's weird ability to highlight/select both rows and columns, (setting its drilldown param to "all"), and then they try and fish out the column that the user clicked using the $click.name2$ token.

The problem usually is that there are only a couple columns where the given behavior is desired (in this case clickability), and the problem becomes how to turn off the behavior for the others.

You could in theory do this though, use the old SimpleResultsTable module and then have some drilldown modules like ValueSetter try and sort this out with the ValueSetter's conditional logic. and then pass to a Redirector. However I do not recommend this.