All Apps and Add-ons

Sideview Utils: How to redirect, but not dispatch a search?

subtrakt
Contributor

Anyone have suggestions on how To Redirect but not dispatch the search? I want the user to be able to enter a ticket before hitting search so it updates the lookup. Right now it works but searches and updates the lookup because the search is dispatched

<module name="SimpleResultsTable">
<param name="entityName">results</param>
<param name="drilldown">row</param>     
    <module name="Redirector">
    <param name="url">flashtimeline</param>
    <param name="popup">True</param>
    &lt;param name="arg.q"&gt;&lt;![CDATA[| stats count | eval testfield="$click.fields.testfield$" | eval ticket="enter ticket number here" | outputlookup append=true testlookup ]]&gt;&lt;/param&gt;
        </module>
        </module>

Or, are there any dashboard examples that i can redirect testfield to that would auto populate a form on the new dashboard, leave a ticket form blank, then have a submit button for the user once they had the ticket form filled?

1 Solution

sideview
SplunkTrust
SplunkTrust

What you want to do, is on the target view if you're not yet using a Button module after your form fields, add one. (Make sure it's a Sideview Button module and not the core Splunk "SubmitButton" module)

and then add this param:

<param name="allowAutoSubmit">False</param>

allowAutoSubmit is a cousin of allowSoftSubmit, but allowAutoSubmit is designed for exactly this use case. To explain further, the more widely known allowSoftSubmit param, set to True/False, governs whether the Button should let through any upstream pushes that come from a user changing a Pulldown, clicking a Checkbox, changing a selection in Pulldown etc... And "allowAutoSubmit", that you also set to True/False, governs whether the Button should let through any pushes that come from the page load.

some examples to show how these two params represent independent behaviors:

On page load the form will populate but NOT submit whatever searchesa re after the Button.

After page load though, the user doesn't have to hit the button explicitly, they can just hit return in TextFields or make selection changes.

<param name="allowSoftSubmit">True</param>
<param name="allowAutoSubmit">False</param>

On page load the form will submit the search. However afterwards the user has to explicitly hit the green button to resubmit the search.

<param name="allowSoftSubmit">False</param>
<param name="allowAutoSubmit">True</param>

View solution in original post

sideview
SplunkTrust
SplunkTrust

What you want to do, is on the target view if you're not yet using a Button module after your form fields, add one. (Make sure it's a Sideview Button module and not the core Splunk "SubmitButton" module)

and then add this param:

<param name="allowAutoSubmit">False</param>

allowAutoSubmit is a cousin of allowSoftSubmit, but allowAutoSubmit is designed for exactly this use case. To explain further, the more widely known allowSoftSubmit param, set to True/False, governs whether the Button should let through any upstream pushes that come from a user changing a Pulldown, clicking a Checkbox, changing a selection in Pulldown etc... And "allowAutoSubmit", that you also set to True/False, governs whether the Button should let through any pushes that come from the page load.

some examples to show how these two params represent independent behaviors:

On page load the form will populate but NOT submit whatever searchesa re after the Button.

After page load though, the user doesn't have to hit the button explicitly, they can just hit return in TextFields or make selection changes.

<param name="allowSoftSubmit">True</param>
<param name="allowAutoSubmit">False</param>

On page load the form will submit the search. However afterwards the user has to explicitly hit the green button to resubmit the search.

<param name="allowSoftSubmit">False</param>
<param name="allowAutoSubmit">True</param>
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...