All Apps and Add-ons

Linking From Sideview table to Pivot Interface

etchouako
Explorer

In Splunk, if your table is based on a Pivot you get the option to Open in Pivot. Can you have the same behavior on a dashboard built with sideview? If so how.

0 Karma

sideview
SplunkTrust
SplunkTrust

Certainly. With Sideview Utils basically all drilldowns to other pages are done with the Redirector module and the Redirector can specify any dynamic or static arguments to any dynamic or static URL.

for example if you wanted to send the user to the pivot URL:

pivot?earliest=0&q=| pivot internal_audit_logs searches count(searches) AS "Count of Searches" ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1

you would use this Redirector config:

<module name="Redirector">
  <param name="url">pivot</param>
  <param name="arg.earliest">0</param>
  <param name="arg.q">| pivot internal_audit_logs searches count(searches) AS "Count of Searches" ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</param>
</param>

If you need to change the app then you would put an absolute URL into the URL like /app/search/pivot instead of pivot.

If you want to incorporate any number of dynamic $foo$ tokens into either the target page, or any of the argument names, or any of the argument values, just include the $foo$ tokens inline.

As to real world instructions, manually construct the pivot state you want to link to, then save that URL off somewhere save. Clip off the "accSID" argument and do not include that argument in the Redirector (pivot will actually work fine without it and generate the sid then-and-there). And parametrize the pieces you need into $foo$ tokens.

0 Karma

etchouako
Explorer

I am asking for a) whether a Table module in a dashboard built with Sideview Utils can have an "open in pivot" workflow?

0 Karma

sideview
SplunkTrust
SplunkTrust

To clarify, are you asking
a) whether a Table module in a dashboard built with Sideview Utils can have an "open in pivot" workflow?
or
b) whether the same Table module can have an "open in Sideview Report Builder" workflow.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...