SideViewUtils : How to Open in Search

[koshyk]

In Splunk6 default simple xml dashboards, there is an option to Open Dashboard as a search. This is particularly useful for debugging purposes. ("Open in Search" option)

Is there a similar option with Sideview Utils dashboards/charts?

[sideview · Accepted solution]

1) The easiest way is to paste this into the view:

<module name="Link">
  <param name="label">Open in Search</param>
  <module name="Redirector">
    <param name="url">search</param>
    <param name="arg.q">search $search$</param>
    <param name="arg.earliest">$search.timeRange.earliest$</param>
    <param name="arg.latest">$search.timeRange.latest$</param>
    <param name="target">_blank</param>
  </module>
</module>

It's kind of a lot of lines for such a simple link, but everything's at least fairly open about what it's doing.

In general whenever you use Redirector, you take the URL you want to end up with, and you break up all the querystring arguments (ie the ?q=search foo&username=mildred part) and you file all those away into the Redirector's arg.* params. The actual url param itself can be a full URL like http://google.com, but when you're just linking from view A to view B in the same app, you can just specify the view name and it becomes a relative link and the browser will know what to do.

and you can use the popup and target params and they'll do what you expect. Also for very advanced cases around when you have set popup to true, you can also use the windowFeatures param to customize the popup window size and scrollbars etc...

2) The old way to do it with Sideview Utils, before the Link module was to use the HTML module, but in many cases you had to use a ValueSetter module to manually url-encode the arguments and this was very tedious. The Link module was created to make this easier.

3) the old Splunk module ViewRedirectorLink still works, but you may find it limited. Link and Redirector will repay the time invested in them because you'll find them both useful in other use cases down the road.

[sideview]

I am? woohoo!

[koshyk]

great. you are a hero

[sideview]

Sure although there's no absolutely bulletproof way.

Assuming your postprocess searches dont have a leading pipe char (unfortunately splunk accepts them both with and without), then replace

<param name="arg.q">search $search$</param>
with

<param name="arg.q"> search $search$ | $postProcess$</param>

If your postprocess searches do have that leading pipe, then omit the pipe above. And now that I've called your attention to it you'll notice that this wont work well for searches that begin with generating commands like | metadata type=sourcetypes". =/

[koshyk]

thanks for it. I'm not able to view the "postprocess" module searches as part of this. Any chance to display the postprocess bit as well?

[somesoni2]

There is a module calling "ViewRedirectorLink" in advanced xml, using which you can open the search populating the table/chart in the search screen. See example below.

<module name="Search" layoutPanel="panel_row2_col2" >
                <param name="search">
                 ....Your search....
                </param>                               
                <module name="Pager">
                  ....
                  <module name="Table">
                    ......
                  </module>
                  <module name="ViewRedirectorLink">
                    <param name="viewTarget">flashtimeline</param>
                    <param name="popup">True</param>
                  </module>
                </module>
              </module>

Another option using Sideview Util's HTML module is described here.
http://answers.splunk.com/answers/100227/postprocess-viewredirectorlink