All Apps and Add-ons

Linking From Sideview table to Pivot Interface

etchouako
Explorer

In Splunk, if your table is based on a Pivot you get the option to Open in Pivot. Can you have the same behavior on a dashboard built with sideview? If so how.

0 Karma

sideview
SplunkTrust
SplunkTrust

Certainly. With Sideview Utils basically all drilldowns to other pages are done with the Redirector module and the Redirector can specify any dynamic or static arguments to any dynamic or static URL.

for example if you wanted to send the user to the pivot URL:

pivot?earliest=0&q=| pivot internal_audit_logs searches count(searches) AS "Count of Searches" ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1

you would use this Redirector config:

<module name="Redirector">
  <param name="url">pivot</param>
  <param name="arg.earliest">0</param>
  <param name="arg.q">| pivot internal_audit_logs searches count(searches) AS "Count of Searches" ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</param>
</param>

If you need to change the app then you would put an absolute URL into the URL like /app/search/pivot instead of pivot.

If you want to incorporate any number of dynamic $foo$ tokens into either the target page, or any of the argument names, or any of the argument values, just include the $foo$ tokens inline.

As to real world instructions, manually construct the pivot state you want to link to, then save that URL off somewhere save. Clip off the "accSID" argument and do not include that argument in the Redirector (pivot will actually work fine without it and generate the sid then-and-there). And parametrize the pieces you need into $foo$ tokens.

0 Karma

etchouako
Explorer

I am asking for a) whether a Table module in a dashboard built with Sideview Utils can have an "open in pivot" workflow?

0 Karma

sideview
SplunkTrust
SplunkTrust

To clarify, are you asking
a) whether a Table module in a dashboard built with Sideview Utils can have an "open in pivot" workflow?
or
b) whether the same Table module can have an "open in Sideview Report Builder" workflow.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...