All Apps and Add-ons

[Sideview Utils] How to pass values from a module to all the subtree hierarchy

guilhem
Contributor

Hello!

Yet another question about the wonderfull sideview utils framework for splunk:

I have this module hierarchy:

                 Pulldown
                     |
                 Switcher
                     |
    First search        Second search       third search

The pulldown values are 1, 2, 10 and -1 for example, the pulldown name is cbSelectVersion
The switcher module switch on the group $cbSelectVersion$.
After the searches there are several views/ searches mixed.

I want to pass the value of the selected pulldown to the whole subtree of module, and not only to the first module, I mean that it seems from what I have read that it is the case, but if my pulldown module name is "cbSelectVersion", it seems that I can have access to this variable only in the switcher module, and not in the searches that are at a depth n+2 in the subtree.

I was wondering if it was possible to set variable values and to pass them to the whole subtree of module, and more generally if it is the right way to proceed. Because I can't see how to do it otherwise.

I want to do this because in the subtree of mudules I have searches that requires the value of the pulldown to retrieve results according to the value selected in the pulldown.

eg: I would like to have a search like this:

  • | top $cbSelectedVersion$ | "do some stuff"

But it doesn't seem to work, although the switcher switchs well.

Any clue or method to achieve this are greatly appreciated.

Many thanks!

1 Solution

sideview
SplunkTrust
SplunkTrust

The key will be available all the way downstream through each subtree. It doesn't get absorbed by the Switcher or anything. You can use it in multiple searches or display it in multiple headers, as many times as you like.

I'm not sure what's going wrong, but I suspect you can cast more light on the situation by inserting one or two HTML modules as debugging tools:

<module name="HTML">
  <param name="html"><![CDATA[
    The search right here is -- <b>$search$</b><br>
    <br>
    and the cbSelectedVersion is <b>$cbSelectedVersion$</b>
  ]]></param>
</module>

Also, if you post the XML or email it to me at nick [at] sideviewapps.com, often times people throw in one or more ingredients too many. For instance when you replace TabSwitcher with Tabs + Switcher, often you can refactor the entire "Switcher" part away and use only the Tabs module if you think about it differently. In Sideview Utils the Switcher module becomes more of a nuclear option that you use as a last resort.

If you're interested in testing out Sideview Utils 2.2, there's a Multiplexer module and a Table module that can do a pretty dramatic range of use cases. PostProcess plus ResultsValueSetter plus Switcher can cover a really huge long tail of advanced use cases. But when you add in Multiplexer and Table it gets even more fun. The hardest part for me is to stay 95% focused on the simpler stuff cause that's what 99% of the users are using Utils for. Pulldowns and Searches and drilldowns.

View solution in original post

sideview
SplunkTrust
SplunkTrust

The key will be available all the way downstream through each subtree. It doesn't get absorbed by the Switcher or anything. You can use it in multiple searches or display it in multiple headers, as many times as you like.

I'm not sure what's going wrong, but I suspect you can cast more light on the situation by inserting one or two HTML modules as debugging tools:

<module name="HTML">
  <param name="html"><![CDATA[
    The search right here is -- <b>$search$</b><br>
    <br>
    and the cbSelectedVersion is <b>$cbSelectedVersion$</b>
  ]]></param>
</module>

Also, if you post the XML or email it to me at nick [at] sideviewapps.com, often times people throw in one or more ingredients too many. For instance when you replace TabSwitcher with Tabs + Switcher, often you can refactor the entire "Switcher" part away and use only the Tabs module if you think about it differently. In Sideview Utils the Switcher module becomes more of a nuclear option that you use as a last resort.

If you're interested in testing out Sideview Utils 2.2, there's a Multiplexer module and a Table module that can do a pretty dramatic range of use cases. PostProcess plus ResultsValueSetter plus Switcher can cover a really huge long tail of advanced use cases. But when you add in Multiplexer and Table it gets even more fun. The hardest part for me is to stay 95% focused on the simpler stuff cause that's what 99% of the users are using Utils for. Pulldowns and Searches and drilldowns.

sideview
SplunkTrust
SplunkTrust

Well it can't be a view, but you can certainly have a single sub-branch under a Switcher contain multiple Search modules. Sometimes it's useful to use a NullModule or a CustomBehavior module right under the Switcher just so it can be the single common parent for several other downstream modules.

0 Karma

smolcj
Builder

can we include more than one search in one switcher, from pulldown to switcher to first search, can this first search be a view with more than ne hidden search and its results?

0 Karma

sideview
SplunkTrust
SplunkTrust

Yep. The key will continue to propagate downward until it is overwritten by something that writes to the same key.

And 2.2 is indeed not live yet. I'm still doing some final testcases and documentation.

0 Karma

guilhem
Contributor

Thanks you again for being so reactive, in fact it was a typo -_-'.

Everything now just work nicely!

Thanks again for the framework, it is exactly what I needed.

Just to be sure, if I declare another time a cbSelectVersion in one of the module of the subtree, what will happen? The new value will take precedence over the previous value? Or is it just ignored and the old value is kept?

Considering testing the 2.2 version it looks really interesting, but it is not online yet, I can't find it on the website.

0 Karma

sideview
SplunkTrust
SplunkTrust

Just on the off chance... In your question you said the Pulldown's name param was cbSelectVersion, but then in your search you're referencing $cbSelectedVersion$, which is different.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...