All Apps and Add-ons
Highlighted

drilldown from a hidden column

Path Finder

In a dashboard, I have a SimpleResultsTable with a drilldown that uses:

<module name="SimpleResultsTable">                                            
  <param name="drilldown">row</param>
  <module name="Redirector">
         <param name="url">next_page</param>
         <param name="arg.key">$click.fields.key$</param>
  </module>
...

In this case "key" is a unique key that will determine the next_page's search.

The problem is that I would like key to not display in the results table (just be available for the drilldown). The value of "key" is not anything a user should ever see.

Is there anyway to add that field to the table but hide the column, or anything else that will make this possible.

Thanks

-Kevin

Highlighted

Re: drilldown from a hidden column

Influencer

Editor's note: please see next answer down for modern, Splunk 6.x+ method of doing this

--

When drilldown is set to row, the module uses the value in the first column of each row as drilldown value. So you can put the field you want to hide in the first column and then hide it using some Javascript in application.js.

Example:

if(Splunk.util.getCurrentView() == "myview") {
    Splunk.Module.SimpleResultsTable = $.klass(Splunk.Module.SimpleResultsTable, {
        renderResults: function($super,data) {
            $super(data);
            $('td:nth-child(2),th:nth-child(2)', this.container).hide();
        }
    });
}

View solution in original post

Highlighted

Re: drilldown from a hidden column

SplunkTrust
SplunkTrust

Your first sentence is technically not true if you're using Sideview Utils. Using the $click.fields.fieldName$ syntax you can get the value for any field in the entire row. You're no longer limited to just the first field. Conversely, within core Splunk UI, the "first column" limitation absolutely applies.

Highlighted

Re: drilldown from a hidden column

Influencer

Ah ok, I wasn't aware of this. Great enhancement btw 😉

0 Karma
Highlighted

Re: drilldown from a hidden column

Explorer

Hi.
I have a same problem. So, I'm now apply the application.js and solve the problem. But field's name is not hide.
If the table have 4 fields - first field is hidden , 4 fields name , 3 data fields ard displayed.
Do you understand my question?

0 Karma
Highlighted

Re: drilldown from a hidden column

Splunk Employee
Splunk Employee

Very cool, just threw this into a couple of Splunk on Splunk views!

0 Karma
Highlighted

Re: drilldown from a hidden column

SplunkTrust
SplunkTrust

If you're using a recent version of Sideview Utils, you can use the Table module instead of Splunk's SimpleResultsTable module.

This get you a couple big benefits. First of all, at least for you, is that it has a "hiddenFields" param, which you can use to have field values present in the data, available for drilldowns, but not actually rendered in the table columns.

Secondly, you can use $row.fields.myFieldName$ and $row.fields.someOtherFieldName$ to refer to the field values in the given selected row.

Note that it's "row" instead of SimpleResultsTable's "click". There's a good reason for this name change and it'll make more sense as you use the Table module more. You can always change it away from "row" if you like just by setting the Table module's optional "name" param.

There are several pages of documentation within the Sideview Utils app itself that will tell you all you need to know about the Table module and how to use it.

1) Download the latest version of Sideview Utils (2.2.10) from the Sideview site at http://sideviewapps.com/apps/sideview-utils. Note that if you think you have the app already you probably have the old version from Splunkbase (1.3.5).

2) Install the app, navigate to it and then navigate to "Module Documentation > The Table Module" and go from there. There are several pages and the hiddenFields stuff is pretty early on.

Highlighted

Re: drilldown from a hidden column

Path Finder

Hey! I was wondering if this still works, I really need to drilldown values from a hidden field and not sure how to do so

0 Karma
Highlighted

Re: drilldown from a hidden column

Motivator

See my answer above, and the comments beneath it.

0 Karma
Highlighted

Re: drilldown from a hidden column

Motivator

If you are using Splunk 6.0+, with its redesigned UI, it is more simple to do a drilldown based on a hidden column.

In the SimpleXML dashboard, specify which fields should be displayed in the table as such:

Splunk 6.0-6.4.x

<option name="fields">field1,field2,field4,count</option>

Splunk 6.5+

<fields>field1,field2,field4,count</fields>

The other fields, including field3 (output by the search but not listed in the option above) will still be available to the drilldown as $row.field3$.