All Apps and Add-ons

Passing variables to other forms in Sideview

cphair
Builder

I'm sure this is a dumb question, but my brain is not working today and it's kind of urgent that I figure this out. I can't figure out how to pass click variables to a new view. I have a table of values (time, host, CpuLoad) that result from one search, and I want to load a separate view with a distinct search that takes the clicked-on time and host as arguments. (I guess I could load them in another panel in the same form if that's easier; I just need to run an entirely new search.) I've tried to copy the sideview examples (the views are already in advanced XML), but all that happens is that my second form gets the literal strings $click.fields.host$ and $click.fields.time$ and doesn't substitute the variables. What am I doing wrong?

0 Karma
1 Solution

cphair
Builder

Oh, good lord. Was passing variables to a HiddenSearch instead of a Search. Once I changed that it worked fine.

This was a helpful link for debugging: http://splunk-base.splunk.com/answers/24278/having-trouble-with-custom-drilldowns-in-advanced-xml

View solution in original post

disha
Contributor

Hi,

I am in the same situation like I want to pass clicked value to another form. I have a value (EventID) that result from one search, and I want to load a separate view with a distinct search that takes the clicked-on EventID as argument using sideviewUtils. Also I am stuck with how to autorun the form with new clicked values. Please help.

0 Karma

cphair
Builder

@disha, I would recommend posting a new question (and maybe including a link to this one in the new post). Since this is marked as answered and accepted, it won't get the same attention that a new question would.

0 Karma

cphair
Builder

Oh, good lord. Was passing variables to a HiddenSearch instead of a Search. Once I changed that it worked fine.

This was a helpful link for debugging: http://splunk-base.splunk.com/answers/24278/having-trouble-with-custom-drilldowns-in-advanced-xml

Get Updates on the Splunk Community!

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...