drilldown from a hidden column

[kkalmbach]

In a dashboard, I have a SimpleResultsTable with a drilldown that uses:

<module name="SimpleResultsTable">                                            
  <param name="drilldown">row</param>
  <module name="Redirector">
         <param name="url">next_page</param>
         <param name="arg.key">$click.fields.key$</param>
  </module>
...

In this case "key" is a unique key that will determine the next_page's search.

The problem is that I would like key to not display in the results table (just be available for the drilldown). The value of "key" is not anything a user should ever see.

Is there anyway to add that field to the table but hide the column, or anything else that will make this possible.

Thanks

-Kevin

[Jason]

If you are using Splunk 6.0+, with its redesigned UI, it is more simple to do a drilldown based on a hidden column.

In the SimpleXML dashboard, specify which fields should be displayed in the table as such:

Splunk 6.0-6.4.x

<option name="fields">field1,field2,field4,count</option>

Splunk 6.5+

<fields>field1,field2,field4,count</fields>

The other fields, including field3 (output by the search but not listed in the option above) will still be available to the drilldown as $row.field3$.

[santosh_sshanbh]

This helped me to hide a column from a table

[samuelmah]

Is there anyway for "fields" to take a variable? I want to be able to show/hide columns from a user option.

*somehow when I specify fields with "<" and ">" it gets removed from the comments. :s

[Jodge]

As of Splunk 6.5 the option "fields" has been deprecated.

So, instead now it is just:

<fields>field1,field2,field4,count</fields>

And exactly as before field3 will still be available to the drilldown as $row.field3$.

[Jason]

Yes, thanks, just noticed that - though <option name="fields"> still works, it will be flagged as deprecated by the nice new xml editor. Updated post.

[cwb2]

This worked great for me. Thanks!

[sideview]

If you're using a recent version of Sideview Utils, you can use the Table module instead of Splunk's SimpleResultsTable module.

This get you a couple big benefits. First of all, at least for you, is that it has a "hiddenFields" param, which you can use to have field values present in the data, available for drilldowns, but not actually rendered in the table columns.

Secondly, you can use $row.fields.myFieldName$ and $row.fields.someOtherFieldName$ to refer to the field values in the given selected row.

Note that it's "row" instead of SimpleResultsTable's "click". There's a good reason for this name change and it'll make more sense as you use the Table module more. You can always change it away from "row" if you like just by setting the Table module's optional "name" param.

There are several pages of documentation within the Sideview Utils app itself that will tell you all you need to know about the Table module and how to use it.

1) Download the latest version of Sideview Utils (2.2.10) from the Sideview site at http://sideviewapps.com/apps/sideview-utils. Note that if you think you have the app already you probably have the old version from Splunkbase (1.3.5).

2) Install the app, navigate to it and then navigate to "Module Documentation > The Table Module" and go from there. There are several pages and the hiddenFields stuff is pretty early on.

[pamcarvalho]

Hey! I was wondering if this still works, I really need to drilldown values from a hidden field and not sure how to do so

[Jason]

See my answer above, and the comments beneath it.

[ziegfried · Accepted solution]

Editor's note: please see next answer down for modern, Splunk 6.x+ method of doing this

--

When drilldown is set to row, the module uses the value in the first column of each row as drilldown value. So you can put the field you want to hide in the first column and then hide it using some Javascript in application.js.

Example:

if(Splunk.util.getCurrentView() == "myview") {
    Splunk.Module.SimpleResultsTable = $.klass(Splunk.Module.SimpleResultsTable, {
        renderResults: function($super,data) {
            $super(data);
            $('td:nth-child(2),th:nth-child(2)', this.container).hide();
        }
    });
}

[hexx]

Very cool, just threw this into a couple of Splunk on Splunk views!

[lanying]

Hi.
I have a same problem. So, I'm now apply the application.js and solve the problem. But field's name is not hide.
If the table have 4 fields - first field is hidden , 4 fields name , 3 data fields ard displayed.
Do you understand my question?

[ziegfried]

Ah ok, I wasn't aware of this. Great enhancement btw 😉

[sideview]

Your first sentence is technically not true if you're using Sideview Utils. Using the $click.fields.fieldName$ syntax you can get the value for any field in the entire row. You're no longer limited to just the first field. Conversely, within core Splunk UI, the "first column" limitation absolutely applies.