All Apps and Add-ons

Sideview Utils - Textfield Default Values from URL

ianshefferman
Explorer

My question is fairly identical to this old one here: http://splunk-base.splunk.com/answers/83479/pass-foo-value-to-textfield-default

It seems that user was having the same problem as me, and his issue did not appear to get resolved.

I have a view that looks pretty much like this: bpaste.net/show/kDAzkyf0yiOGc1geSM5p/

I want the Textfields to display URL parameter values as their default value.

When I visit the URL with parameters like "/app/search/viewname?IP=1.1.1.1&time=whatever", the HTML module properly substitutes the $foo$ values ($IP$ and $time$), but the Textfields simply remain blank. They are definitely spelled and cased properly. I also tried adding a "default" param to each Textfield, but that does not work ($IP$ remains as a literal $IP$).

I am running the latest versions of both Sideview and Splunk.

1 Solution

sideview
SplunkTrust
SplunkTrust

It's not intuitive, but as with Pulldown prepopulation, you need to add an autoRun="True" attribute to the top module in the view. In this case to the URLLoader module.

That will cause an initial push when the page loads and it's only when that push happens that the prepopulation will happen.

Note that of course the autoRun push will also dispatch all the searches on the page. If you dont want that to happen you can explore using a Button module with its allowAutoSubmit param set to False, to prevent this.

Back to the weirdness of autoRun being required here - With a Pulldown module it's maybe a bit more forgivable, because the autoRun is often also necessary to kick off the Pulldown's search. With TextField it's just weird I admit. The good news is that I think it's fixable with TextField so I'll take a look. Specifically I think in a near-future version I can correct this behavior and get your TextField's prepopulating without the need for you to add an autoRun="True".

Also, that other question was indeed answered if you read the comment thread he had a couple other typos and issues going on, but we got him sorted in the end.

View solution in original post

sideview
SplunkTrust
SplunkTrust

It's not intuitive, but as with Pulldown prepopulation, you need to add an autoRun="True" attribute to the top module in the view. In this case to the URLLoader module.

That will cause an initial push when the page loads and it's only when that push happens that the prepopulation will happen.

Note that of course the autoRun push will also dispatch all the searches on the page. If you dont want that to happen you can explore using a Button module with its allowAutoSubmit param set to False, to prevent this.

Back to the weirdness of autoRun being required here - With a Pulldown module it's maybe a bit more forgivable, because the autoRun is often also necessary to kick off the Pulldown's search. With TextField it's just weird I admit. The good news is that I think it's fixable with TextField so I'll take a look. Specifically I think in a near-future version I can correct this behavior and get your TextField's prepopulating without the need for you to add an autoRun="True".

Also, that other question was indeed answered if you read the comment thread he had a couple other typos and issues going on, but we got him sorted in the end.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...

Trusted Autonomy in the SOC: A Maturity Journey

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...