All Apps and Add-ons

Drilldown from one of three tables to one table of results

kmattern
Builder

Running Splunk 5.0.4.

I have three tables displaying in one panel, each table in a different group. There is a single column named Publication in each table. Each table also has a time picker so that different time ranges can be displayed in each table.

In a second panel I want to display a single table that will change based on the publication selected for drilldown on one of the three tables. But when I drilldown from more than one table I get up more than one output table in the second panel. They are stacked vertically.

I figure that if I nest my modules properly I should be able to display my drilldown results on only one table.

I'm using Sideview Utils 2.6

1 Solution

sideview
SplunkTrust
SplunkTrust

Yes. This is a perfect use case for the Gate module. Specifically for the functionality it has around its "to" and "id" params.

There is a page of documentation and working examples inside the Sideview Utils app itself

"Module Documentation > The Gate Module > Gate - Complex Drilldowns"

but to give you the gist of it here - you put a Gate module as the bottommost module in each of the 3 drilldown configs of the left hand side. So three Gate modules total there. You can put them just inside the Table modules or if there are other necessary bits under each Table like ValueSetter modules, inside those necessary modules. Those Gate modules should have no downstream modules.

Give each of them a <param name="to">rightSide</param>

Now put one Gate module upstream from your Table config on the right side and give that one

<param name="id">rightSide</param>

Then each of the three drilldowns on the left hand side will push to that single Table on the right side.

you also can nest the right side Gate module inside some other stuff, and that'll all work as you expect too, in that the tokens will all merge correctly and if a $foo$ token comes from both the Gate and from the normal upstream modules, the Gate value will override. So in other words you can mix communication via Gate modules with normal downstream communication and it merges fine.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Yes. This is a perfect use case for the Gate module. Specifically for the functionality it has around its "to" and "id" params.

There is a page of documentation and working examples inside the Sideview Utils app itself

"Module Documentation > The Gate Module > Gate - Complex Drilldowns"

but to give you the gist of it here - you put a Gate module as the bottommost module in each of the 3 drilldown configs of the left hand side. So three Gate modules total there. You can put them just inside the Table modules or if there are other necessary bits under each Table like ValueSetter modules, inside those necessary modules. Those Gate modules should have no downstream modules.

Give each of them a <param name="to">rightSide</param>

Now put one Gate module upstream from your Table config on the right side and give that one

<param name="id">rightSide</param>

Then each of the three drilldowns on the left hand side will push to that single Table on the right side.

you also can nest the right side Gate module inside some other stuff, and that'll all work as you expect too, in that the tokens will all merge correctly and if a $foo$ token comes from both the Gate and from the normal upstream modules, the Gate value will override. So in other words you can mix communication via Gate modules with normal downstream communication and it merges fine.

kmattern
Builder

That's great. It works like a charm.

Thanks Nick

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...