All Apps and Add-ons

I have a question about the title "drilldown from a hidden column".- Help me~~

lanying
Explorer

Hi.
I made a drilldown dashboard and first field's value was sending to another view.
But first fields' value is too long , I just made a hidden colum for sending.

<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <module name="SideviewUtils" layoutPanel="appHeader" />
  <module name="HiddenSearch" layoutPanel="panel_row3_col1" autoRun="True">
    <module name="Search">
      <param name="search">sourcetype=tms_syslog | stats sum(Count) as Count by EventName | join type=left EventName [SEARCH sourcetype=attack_type] | fields EventName Count ATTACK_NAME| eval Event_Name=if(len(EventName) >30 , substr(EventName,1,30)+"...", EventName) | fields EventName Event_Name Count ATTACK_NAME | rename Event_Name  as "이벤트명" ATTACK_NAME as "공격유형" | sort - Count</param>
      <param name="earliest">-1h</param>
      <module name="JobProgressIndicator"></module>
        <module name="SimpleResultsTable">
          <param name="entityName">results</param>
          <param name="drilldown">row</param>
          <param name="displayRowNumbers">False</param>
      <param name="count">100</param>
          <module name="Redirector">
            <param name="popup">true</param>
            <param name="url">myView</param>
            <param name="arg.event">$click.value$</param>
          </module>
        </module>
    </module>
  </module>
</view>

In this site, I found a answer that asked to apply an application.js

if(Splunk.util.getCurrentView() == "myview") {
    Splunk.Module.SimpleResultsTable = $.klass(Splunk.Module.SimpleResultsTable, {
        renderResults: function($super,data) {
            $super(data);
            $('td:nth-child(2),th:nth-child(2)', this.container).hide();
        }
    });
}

So, I'm now apply the application.js and solve the problem. But field's name is not hide. If the table have 4 fields (first field is hidden) , 4 fields name , 3 data fields ard displayed. Do you understand my question?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

Did you change the "myview" in the example code to be the name of your view?

View solution in original post

0 Karma

kevynchase
New Member

if u no who is kevyn chase or imaginary.please contact. i look into the drilldown search criteria because actually a password of mine is drillhead. cathydhs(at)verizon.net engebretcathy(at)gmail.com 7606766832 7603298446 cathy

0 Karma

sideview
SplunkTrust
SplunkTrust

I'm sorry but I don't understand this comment at all.

0 Karma

sideview
SplunkTrust
SplunkTrust

Minor Note: the HiddenSearch module at the top isn't doing anything and can be removed. Sideview's Search module can do it all just fine. Of course when you do remove it, move the autoRun attribute down to the Search module.

0 Karma

sideview
SplunkTrust
SplunkTrust

Did you change the "myview" in the example code to be the name of your view?

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

Note that view names are case sensitive. so "myview" != "myView"

0 Karma

lanying
Explorer

I made a view. The name is "myView"..

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!