All Apps and Add-ons

Using ResultsActionButtons with Sideview

Splunk Employee
Splunk Employee

I have a Sideview based report builder, and I want to provide users the ability to export results, link to results, save reports, and all the wonder that's provided by ResultsActionButtons. The export and save work, and GetLink gives me an ostensibly acceptable url, with the SID, but it doesn't get populated into the SimpleResultsTable.

It appears that my first pulldown-populating search is grabbing the search (which it then fails to use). I've tried using ValueSetter to set the SID to empty, set the search to empty, and set the search to , but I can't seem to get it to line up correctly.

How should I proceed with this? (Is the answer that there is a less-ugly Sideview version of the ResultsActionButtons?)

1 Solution

SplunkTrust
SplunkTrust

The quickest solution is to put a displayView="charting" into your <view> tag. Although this means pretty much all subsequent interaction will dump the user into the charting view, and they will have only that one search box and a TimeRangePicker module, the good news is that it will work. You could also in theory make a view that has no SearchBar nor TimeRangePicker, and that is thus a read-only view, and then set that as the displayView.

The better solution is the approach taken by various Sideview Apps -- Splunk for Cisco CDR, Sideview Web Analytics and Sideview Process Historian. However that approach is quite involved and involves adding 2 extra keys to savedsearches.conf, applying patches to a number of pieces of core splunk functionality from within application.js, and manually redirecting the user from all ?s=foo URLs to ?search.name=foo. As for the ?sid=123143121 URLs, I havent gotten around to making those work even in my own apps so unless I can replace them with sideview-style links, i just take them away entirely.

What all those patches and overrides do is override Splunk's viewstate systems and resurrection systems to instead allow the Sideview prepopulation to take over.

One thing to note, is that especially if you turn 'keepURLUpdated' on in the URLLoader module, then to "send a link" to someone, you can just copy and paste the URL and everything will prepopulate correctly when you send it to someone else. Likewise "saving a search" can arguably be as simple as bookmarking it in your browser. Of course scheduling an alert is a different story, but just for that one piece a read-only view, or sending the user to charting, might be acceptable.

View solution in original post

SplunkTrust
SplunkTrust

The quickest solution is to put a displayView="charting" into your <view> tag. Although this means pretty much all subsequent interaction will dump the user into the charting view, and they will have only that one search box and a TimeRangePicker module, the good news is that it will work. You could also in theory make a view that has no SearchBar nor TimeRangePicker, and that is thus a read-only view, and then set that as the displayView.

The better solution is the approach taken by various Sideview Apps -- Splunk for Cisco CDR, Sideview Web Analytics and Sideview Process Historian. However that approach is quite involved and involves adding 2 extra keys to savedsearches.conf, applying patches to a number of pieces of core splunk functionality from within application.js, and manually redirecting the user from all ?s=foo URLs to ?search.name=foo. As for the ?sid=123143121 URLs, I havent gotten around to making those work even in my own apps so unless I can replace them with sideview-style links, i just take them away entirely.

What all those patches and overrides do is override Splunk's viewstate systems and resurrection systems to instead allow the Sideview prepopulation to take over.

One thing to note, is that especially if you turn 'keepURLUpdated' on in the URLLoader module, then to "send a link" to someone, you can just copy and paste the URL and everything will prepopulate correctly when you send it to someone else. Likewise "saving a search" can arguably be as simple as bookmarking it in your browser. Of course scheduling an alert is a different story, but just for that one piece a read-only view, or sending the user to charting, might be acceptable.

View solution in original post

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!