All Apps and Add-ons

Linking From Sideview table to Pivot Interface

etchouako
Explorer

In Splunk, if your table is based on a Pivot you get the option to Open in Pivot. Can you have the same behavior on a dashboard built with sideview? If so how.

0 Karma

sideview
SplunkTrust
SplunkTrust

Certainly. With Sideview Utils basically all drilldowns to other pages are done with the Redirector module and the Redirector can specify any dynamic or static arguments to any dynamic or static URL.

for example if you wanted to send the user to the pivot URL:

pivot?earliest=0&q=| pivot internal_audit_logs searches count(searches) AS "Count of Searches" ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1

you would use this Redirector config:

<module name="Redirector">
  <param name="url">pivot</param>
  <param name="arg.earliest">0</param>
  <param name="arg.q">| pivot internal_audit_logs searches count(searches) AS "Count of Searches" ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</param>
</param>

If you need to change the app then you would put an absolute URL into the URL like /app/search/pivot instead of pivot.

If you want to incorporate any number of dynamic $foo$ tokens into either the target page, or any of the argument names, or any of the argument values, just include the $foo$ tokens inline.

As to real world instructions, manually construct the pivot state you want to link to, then save that URL off somewhere save. Clip off the "accSID" argument and do not include that argument in the Redirector (pivot will actually work fine without it and generate the sid then-and-there). And parametrize the pieces you need into $foo$ tokens.

0 Karma

etchouako
Explorer

I am asking for a) whether a Table module in a dashboard built with Sideview Utils can have an "open in pivot" workflow?

0 Karma

sideview
SplunkTrust
SplunkTrust

To clarify, are you asking
a) whether a Table module in a dashboard built with Sideview Utils can have an "open in pivot" workflow?
or
b) whether the same Table module can have an "open in Sideview Report Builder" workflow.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...