Sideview load dynamic (local) URL in iframe

[MatMeredith]

I need to support drilling down from a Splunk table to a local (on the Splunk server) HTML file. I want to load the local file inline using an iframe, and when loading the file, I need to pass dynamic parameters in the URL based on the row in the table that the user has clicked.

I thought I could do it like using the Sideview HTML module

<module name="Search">
    <param name="search"> [snip: my_search] </param>
    <module name="Table">
        <module name="HTML">
            <param name="html"><![CDATA[<iframe src="chart.html?$row.fields.ssrc$"></iframe>]]></param>
        </module>                                
    </module>
</module>

But this doesn't work -- my iframe just shows me a 404 error saying that Splunk cannot find view "chart.html". I've put chart.html in /etc/apps//appserver/static. Can anyone tell me what I need to do to make this work please?

[sideview]

If you want to embed a static file from etc/apps/<YOUR_APP>/appserver/static/chart.html into an iframe in a view, you have to point splunk over to the static directories.

What you want in that src attribute is ../../static/app/<YOUR_APP>/chart.html

However spell out more of the details of what you're trying to do. Usually when people take a big dive into writing custom code I can help show them modules and techniques in Sideview Utils that can do the same thing more easily without that big swandive into maintaining a ton of custom code.

[sideview]

oh. hehe. Well that does sound perfect. I saw the $row.fields.ssrc$ in there and it looked like you were doing something interactive in there. Yea, if you already have some supplemental information formatted as HTML go for it. I'd probably look for ways to get that same information into some other more splunklike form like a lookup, but that's just me.

[MatMeredith]

Thanks I'll try that when I'm back in the office. I think this is what I want to do. Alongside the data in this view from Splunk I also need to render some additional information which does not exist inside Splunk... I already have a web page that loads and renders that data in the form that I need - I just want to embed it within my Splunk app...

[sideview]

What kinds of things are you doing in that HTML file? Unless you're doing something very complicated, I'll probably advise staying inside the framework. But if you spell out your use case more I'd be happy to show you what parts of Sideview Utils can (probably) do the same functionality without going off-road like this. In the meantime I'll answer your question momentarily.