All Apps and Add-ons

Sideview Utils 2.1 Redirector not working

responsys_cm
Builder

I have a search that lists a bunch of files over the last 24 hours. I want users to be able to click on a row in the table and have it open a new web page with the appropriate URL value. But when users click on the row, it only opens up a web page with the first URL value in the table.

<module name="Search" layoutPanel="panel_row3_col1" autoRun="True">
    <param name="latest">now</param>
    <param name="earliest">-24h@h</param>
    <param name="search"><![CDATA[
      signature_type="Discovery" signature="First execution on network" | eval   installer=if(isnull(installer),"Unknown",installer) | eval url="http://www.file.net/process  /"+file+".html" | table file,path,process,installer,dest_nt_host,url
    ]]></param>

    <module name="HTML">
      <param name="html"><![CDATA[
        <h3>First Executions - 24 Hours</h3>
        ]]></param>
    </module>

    <module name="Pager">

      <module name="SimpleResultsTable">
        <param name="entityName">results</param>
        <param name="drilldown">row</param>

        <module name="ResultsValueSetter">
          <param name="fields">url</param>

          <module name="Redirector">
            <param name="popup">True</param>
            <param name="url">$url$</param>
          </module>
        </module>
      </module>
      <module name="Pager" />
    </module>
  </module>
</module>
1 Solution

sideview
SplunkTrust
SplunkTrust

You've just got one too many moving parts in here.

ResultsValueSetter does exactly that -- it goes and gets the given field value(s) from the first row of the current search results.

If you instead want to get a value from the row the user clicked on, then anywhere downstream from SimpleResultsTable or FlashChart or JSChart, then you use $click.fields.fieldName$, in this case $click.fields.url$. Note: If you're using hte older 1.3.X version on Splunkbase you'll only have these keys on the SimpleResultsTable module. In 2.0.X and 2.1.X you'll have the keys also downstream from the charting modules.

For example:

<module name="SimpleResultsTable">
  <param name="entityName">results</param>
  <param name="drilldown">row</param>

  <module name="Redirector">
    <param name="url">$click.fields.url$</param>
    <param name="popup">True</param>
  </module>

</module>

Update

and if you want the Redirector to pass a timerange, you'd add the following params to it.

<param name="earliest">$search.timeRange.earliest$</param>
<param name="latest">$search.timeRange.latest$</param>

the arg.* params all map one-to-one to the actual querystring arguments so it's pretty straightforward to construct a redirect to a anywhere, whether its a custom advanced XML view, or whether its a third party web application.

View solution in original post

sideview
SplunkTrust
SplunkTrust

You've just got one too many moving parts in here.

ResultsValueSetter does exactly that -- it goes and gets the given field value(s) from the first row of the current search results.

If you instead want to get a value from the row the user clicked on, then anywhere downstream from SimpleResultsTable or FlashChart or JSChart, then you use $click.fields.fieldName$, in this case $click.fields.url$. Note: If you're using hte older 1.3.X version on Splunkbase you'll only have these keys on the SimpleResultsTable module. In 2.0.X and 2.1.X you'll have the keys also downstream from the charting modules.

For example:

<module name="SimpleResultsTable">
  <param name="entityName">results</param>
  <param name="drilldown">row</param>

  <module name="Redirector">
    <param name="url">$click.fields.url$</param>
    <param name="popup">True</param>
  </module>

</module>

Update

and if you want the Redirector to pass a timerange, you'd add the following params to it.

<param name="earliest">$search.timeRange.earliest$</param>
<param name="latest">$search.timeRange.latest$</param>

the arg.* params all map one-to-one to the actual querystring arguments so it's pretty straightforward to construct a redirect to a anywhere, whether its a custom advanced XML view, or whether its a third party web application.

sideview
SplunkTrust
SplunkTrust

(this was along time ago now, but indeed the "Table" module was launched in Sideview Utils way back in 2.0, so yes you can now do this, using the Table module's "hiddenFields" param. http://sideviewapps.com/apps/sideview-utils

0 Karma

sideview
SplunkTrust
SplunkTrust

Right now, not without using some custom JS code to muck with the SimpleResultsTable yourself. That said, I'm in the process of making a Table module to replace SimpleResultsTable for Sideview users and indeed it has this feature already.

Right now the implementation is that it has an optional "fields" param to narrow down the visible columns. Andalso an optional "hiddenFields" param, to say what other fields should be available to downstream drilldown logic, but not actually displayed in the table.

Follow me on twitter and I'll definitely announce the launch there. ( @sideview_apps )

0 Karma

responsys_cm
Builder

Thanks, Nick.

Is there any way to use a field in the redirector that isn't displayed in the table?

C

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...