All Apps and Add-ons

Linking From Sideview table to Pivot Interface

Explorer

In Splunk, if your table is based on a Pivot you get the option to Open in Pivot. Can you have the same behavior on a dashboard built with sideview? If so how.

0 Karma

SplunkTrust
SplunkTrust

Certainly. With Sideview Utils basically all drilldowns to other pages are done with the Redirector module and the Redirector can specify any dynamic or static arguments to any dynamic or static URL.

for example if you wanted to send the user to the pivot URL:

pivot?earliest=0&q=| pivot internal_audit_logs searches count(searches) AS "Count of Searches" ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1

you would use this Redirector config:

<module name="Redirector">
  <param name="url">pivot</param>
  <param name="arg.earliest">0</param>
  <param name="arg.q">| pivot internal_audit_logs searches count(searches) AS "Count of Searches" ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</param>
</param>

If you need to change the app then you would put an absolute URL into the URL like /app/search/pivot instead of pivot.

If you want to incorporate any number of dynamic $foo$ tokens into either the target page, or any of the argument names, or any of the argument values, just include the $foo$ tokens inline.

As to real world instructions, manually construct the pivot state you want to link to, then save that URL off somewhere save. Clip off the "accSID" argument and do not include that argument in the Redirector (pivot will actually work fine without it and generate the sid then-and-there). And parametrize the pieces you need into $foo$ tokens.

0 Karma

Explorer

I am asking for a) whether a Table module in a dashboard built with Sideview Utils can have an "open in pivot" workflow?

0 Karma

SplunkTrust
SplunkTrust

To clarify, are you asking
a) whether a Table module in a dashboard built with Sideview Utils can have an "open in pivot" workflow?
or
b) whether the same Table module can have an "open in Sideview Report Builder" workflow.

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!