All Apps and Add-ons

Sideview Utils - Textfield Default Values from URL

ianshefferman
Explorer

My question is fairly identical to this old one here: http://splunk-base.splunk.com/answers/83479/pass-foo-value-to-textfield-default

It seems that user was having the same problem as me, and his issue did not appear to get resolved.

I have a view that looks pretty much like this: bpaste.net/show/kDAzkyf0yiOGc1geSM5p/

I want the Textfields to display URL parameter values as their default value.

When I visit the URL with parameters like "/app/search/viewname?IP=1.1.1.1&time=whatever", the HTML module properly substitutes the $foo$ values ($IP$ and $time$), but the Textfields simply remain blank. They are definitely spelled and cased properly. I also tried adding a "default" param to each Textfield, but that does not work ($IP$ remains as a literal $IP$).

I am running the latest versions of both Sideview and Splunk.

1 Solution

sideview
SplunkTrust
SplunkTrust

It's not intuitive, but as with Pulldown prepopulation, you need to add an autoRun="True" attribute to the top module in the view. In this case to the URLLoader module.

That will cause an initial push when the page loads and it's only when that push happens that the prepopulation will happen.

Note that of course the autoRun push will also dispatch all the searches on the page. If you dont want that to happen you can explore using a Button module with its allowAutoSubmit param set to False, to prevent this.

Back to the weirdness of autoRun being required here - With a Pulldown module it's maybe a bit more forgivable, because the autoRun is often also necessary to kick off the Pulldown's search. With TextField it's just weird I admit. The good news is that I think it's fixable with TextField so I'll take a look. Specifically I think in a near-future version I can correct this behavior and get your TextField's prepopulating without the need for you to add an autoRun="True".

Also, that other question was indeed answered if you read the comment thread he had a couple other typos and issues going on, but we got him sorted in the end.

View solution in original post

sideview
SplunkTrust
SplunkTrust

It's not intuitive, but as with Pulldown prepopulation, you need to add an autoRun="True" attribute to the top module in the view. In this case to the URLLoader module.

That will cause an initial push when the page loads and it's only when that push happens that the prepopulation will happen.

Note that of course the autoRun push will also dispatch all the searches on the page. If you dont want that to happen you can explore using a Button module with its allowAutoSubmit param set to False, to prevent this.

Back to the weirdness of autoRun being required here - With a Pulldown module it's maybe a bit more forgivable, because the autoRun is often also necessary to kick off the Pulldown's search. With TextField it's just weird I admit. The good news is that I think it's fixable with TextField so I'll take a look. Specifically I think in a near-future version I can correct this behavior and get your TextField's prepopulating without the need for you to add an autoRun="True".

Also, that other question was indeed answered if you read the comment thread he had a couple other typos and issues going on, but we got him sorted in the end.

Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...