Splunk Search

Creating view result link

elaine0102
Explorer

Hi anyone have links to share with me on how can I create view button for my application.

I displayed some single values & would like to have a view button so that I can view the data of the single value.

Drill-down is kind of hard for me to understand. So I choose to use a view button.

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

While you can use the ViewRedirectorLink to make SingleValue interactive, that only allows you to send the user to the same search results that are used to render the SingleValue, and usually this isn't very helpful to them.

SingleValue does also let you configure a single static search (I think the param is like "linkSearch" or something), that search is purely static and it cannot incorporate the displayed value in the SingleValue module, which often prevents it from being useful.

What I recommend is using the HTML module from Sideview Utils instead of SingleValue. There are extensive docs about the HTML module within the Sideview Utils app itelf (as there are for all the Sideview modules), and specifically there's an entire page about using HTML instead of SingleValue. And beyond merely duplicating what SingleValue can do, it gives you a wider range of possibilities, including the ability to link.

While you should of course start from the simpler docs pages and read all there is to say about the modules, within the Sideview Utils app, that docs page is at "Module Documentation > The HTML Module > Using HTML instead of the SingleValue module".

And lastly, while the HTML module allows you to construct links, I strongly recommend that you consider using the HTML module merely as a display element, and then using a Button module and a Redirector module to do the actual linking off.... Simply because it's much cleaner that way and if you create your own <a> tags in the HTML module then you'll have to worry about urlEncoding things with the ValueSetter. Although this is all covered in that docs page I mentioned, it's usually less work and a better end result to use a Button and a Redirector.

jonuwz
Influencer

Elaine, thats a very good idea to make the SingleValue more interactive.

Example usage :

<view objectMode="SimpleDashboard" refresh="-1" template="dashboard.html">
  <label>wibble</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="DashboardTitleBar" layoutPanel="viewHeader"/>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1_grp1" group="S V" autoRun="True">
    <param name="search">* | head 10 | stats count | eval message="redirect woo"</param>
       <module name="SingleValue"/>
       <module name="ViewRedirectorLink">
         <param name="viewTarget">flashtimeline</param>
         <param name="label">View results</param>
       </module>
  </module>
</view>
0 Karma

elaine0102
Explorer

Hi, thank you. Will try it out!

0 Karma

elaine0102
Explorer

Advanced XML 🙂

0 Karma

bwooden
Splunk Employee
Splunk Employee

Are you using simple XML or advanced XML?

0 Karma

jonuwz
Influencer

@Inguinn - maybe the 'view results' link ?

lguinn2
Legend

That's a nice idea, but does Splunk even have a "view button?"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...