All Apps and Add-ons

SideView Redirector Open in Search to events tab

steverazor
Explorer

I was able to use the Redirector module in SideView to get an "Open in Search" link using the answer provided for this question.

However, I have a further question. Is it possible to force the new search window to open to the "events" tab using one of the arg.* parameters?

I noticed that when I have the page displaying the events tab, the url contains the parameter "display.general.type=events". I attempted to use arg.display.general.type for one of the arguments, but it still opens in the "statistics" tab.

Any advice is much appreciated 🙂

0 Karma

sideview
SplunkTrust
SplunkTrust

I'm afraid that I don't think there's a way to make Splunk's core "search" view always open in the Events tab. What the view uses to make the determination is the nature of the search itself. If the search is just a raw search or if it contains only streaming and non-transforming search commands, then the search will open in the events tab. On the other hand if it has a transforming command like "stats" or "timechart" or even a non-streaming command like "| table *", then it will open in the "Statistics" tab.

What could be added to Sideview Utils, is a special key much like the special keys we already add, like $results.sid$ or $results.doneProgress$, that would be $results.eventSearch$. This could report the "eventSearch" property from the dispatched job. Splunk actually records the non-streaming transforming portion of the search into this property, and we could make it available for this kind of use case. In this case, instead of

<param name="arg.q">search $search$</param>

you would have

<param name="arg.q">$results.eventSearch$</param>

This would discard any commands like stats/timechart that are non-streaming commands and then the search would open in the events tab. Like the other $results.*$ keys, it would only be defined once the UI had actually received information back from the server, so for certain use cases where you need the information only moments after the search dispatches, it won't be there.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...