All Apps and Add-ons

Issue with drilldown using Sideview

theouhuios
Motivator

Hello

I am linking multiple views and in doing so facing an issue with sending the arguments properly to the next view.

In the view3 redirector module is given arguments as

<module name="Redirector">
        <param name="url">target_view4</param>
        <param name="arg.host">$click.value$</param>
        <param name="arg.report">timechart span=1hr avg(Value) by host</param>
        <param name="arg.report1">stats avg(Value) as A by host |eval Available Space = A/1024</param>

      </module>

And in view4 the search which I am using is

<module name="Search" layoutPanel="panel_row1_col2" group="Disk Avail" autoRun="True">
        <param name="search">earliest=-24h@h latest=@h sourcetype="Perfmon:*" host=$host$ collection="Memory" counter="Available Kbytes" |$report1$</param>

But the data isn't getting updated in the singlevalue chart which I am using for this. I placed the HTML module to check on why and this is what I see

DEBUGGING: Here are the keys that get passed down through the modules from URLLoader:

host: WTSDDK22

report1: stats avg(Value) as A by host |eval Available Space = A/1024

search: earliest=-24h@h latest=@h sourcetype="Perfmon:*" host=WTSDDK22 collection="PhysicalDisk" counter="% Disk Time"| timechart span=1hr avg(Value) by host

It should be using the report1 argument instead its using the report. I also checked on the URL, the arguments are passing fine.

Any ideas?

-theou

sideview
SplunkTrust
SplunkTrust

Is it possible that either

a) you've edited the view on disk, but forgotten to hit the refresh endpoint to tell Splunkd to reload it from disk? (Use The FreshMaker in Sideview Utils - there's a link under "Key techniques > Tools")

b) Or that there's a version of the view in /local that's overriding the version in default? wherein it's still specifying $report$ instead of $report1$? If anyone ever edited the view through manager it will have created a second copy in local which completely overrides the one in default. Go to manager and view the source of the view and that will always be the one loaded in memory, no matter what directory it was loaded from.

If the arg.* names in the Redirector are matching the querystring arguments in the target page's URL, and the target page has a URLLoader module, and downstream from that URLLoader module there are $foo$ tokens that match those arguments in the URL, that's all you need.

To go further and prepopulate TextField and Pulldown and Checkbox modules from the URL, all you need is to have the "name" param on those modules also match the arguments in the URL.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...