Parameters between Sideview and non-Sideview

[cphair]

Is it possible to use Redirector to pass parameters to a non-Sideview view (i.e. one that doesn't have the URLLoader module)? The parameters show up in the target view's URL, but they aren't being used. The target view is in simple XML, and I'd rather not convert it if I don't have to.

[sideview · Accepted solution]

It's really not possible, no.

However, if I give you the long answer you might feel like it's almost possible. Here goes.

The only way you can pass things to another view in core splunk is by passing a full search string as ?q=foo|timechart count along with earliest/latest, by passing savedsearch name as ?s=foo, or by passing a search id as ?sid=1231241412. Note that in all cases you're really passing an entire single search, and not just a single argument.

When the core XML view receives one of those three arguments, whether it's a simplified view or an advanced XML view, the module system will try to run that search in all of the subtrees of the view. If the view has only one one long, deep, ie super-nested subbranch of modules like the flashtimeline view or the advanced charting view, this generally works. The single search gets 'resurrected' in the target view.

With the simplified xml though, you're generally dealing with more than one chart/table. At best you'll end up with that one search running identically in all panels. At worst things will go very wrong and you'll get error messages and/or very confusing search results.

Hypothetically, if there's only one panel in the simplified XML, it might work. I've never tried. You might try it and take a very close look at whether it's really running the right search. In the end I recommend converting the view to advanced XML because the URLLoader's method is much simpler and more intuitive.

[sideview]

To back up a second though... Certainly the Redirector module can pass standard "q", "earliest", and "latest" args to views like charting and flashtimeline. So in that sense you can link to non-Sideview target views. It's just in the non-trivial cases where you want to link to a more custom view that it wont work right.

[sideview]

After you use $foo$ tokens in the Sideview system, you come to expect the same tokens to work intuitively in core splunk modules, but they really dont. I don't think there's any way to do this I'm afraid. At least not without writing a bunch of custom javascript at the app-level to patch and customize the behavior. Note that the $foo$ tokens, as they appear in HiddenSearch, can only substitute "intentions" called "foo". Whereas with the Search module from Utils, the $foo$ values can pull in any simple token (and you never use intentions at all).

[cphair]

Okay, thanks.

Next question: Can I override an intention in the target view? I'm testing with another view that has a stringreplace intention with a default value for the field I'm trying to pass in, and the search contains that $parameter$ explicitly. The search time (which isn't a parameter in the target search) is passed through correctly, but the other field ends up with the target's default value.