All Apps and Add-ons

Sideview Utils: How to display a button based on a field returned by a search result?

spyme72
Path Finder

i want to display a button in my view and i am using Sideview utils.
i want the button to be displayed based on a field returned by a search result.

example:

index=abc | fields user, status,tobedeleted

if the field tobedeleted is true i want to display a button,else i dont want the button to be displayed.

sideview
SplunkTrust
SplunkTrust

Certainly. Here is a simple self-contained example where there is a field called "showme" whose value is either "true" or "false". And the Button is embedded only inside hte Table rows that have showme="true".

<module name="Search" layoutPanel="panel_row4_col2" autoRun="True" group="Buttons only show for some rows">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group="per_sourcetype_thruput" | head 1000 | stats sum(kb) as totalKB by series | eval actions="PLACEHOLDER" | streamstats count | eval showme=if(count=="2","true","false")
  ]]></param>

  <module name="Pager">

    <module name="Table">

      <module name="ValueSetter" group="row.fields.actions">
        <param name="name">foo</param>
        <param name="if.$row.fields.showme$=true">1</param>

        <module name="Gate">
          <param name="requiredKeys">foo</param>

          <module name="Button">
            <param name="allowAutoSubmit">False</param>
            <param name="customBehavior">confirmationPopup</param>

            <module name="Redirector">
              <param name="popup">True</param>
              <param name="url">http://google.com</param>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

You can of course use the Table module's "hiddenFields" to hide the actual rendered "showme" or "tobedeleted" column from the end user and it will still work.

As to how/why this implementation works -- the ValueSetter module uses it's conditional logic to create a $foo$ token that will only be defined on certain rows. Then the Gate module will either block or allow the downstream push based on that token. Then last but not least the Button module happens to have a behavior where it wont render itself until the first push is received.

If the Button didn't have that default behaviour then we'd have to cook up another way, possibly using the Sideview ShowHide module.

spyme72
Path Finder

awesome that's good to know.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...