Knowledge Management

How can I use the arg value defined in redirector view in three different search strings.

Aakanksha
Path Finder

Hi,

I am using Google map. code is below

<module name="ConvertToIntention">
  <param name="settingToConvert">maps.drilldown</param> 
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="Nodes"> 
        <param name="value">$click.value$</param>
      </param> 
    </param>
  </param> 
  <module name="ViewRedirector">
    <param name="viewTarget">Accessibility</param>
  </module>
</module>

How can I use the passed value(args Nodes) in redirector view (Accessibilty) in three different search strings.

Tags (1)

sideview
SplunkTrust
SplunkTrust

Note that Redirector is a Sideview module, and you use it quite differently than you're using the ConvertToIntention and ViewRedirector modules here.

If you intended to ask about the Sideview Redirector module, then instead of the above XML you have, you would do this:

<module name="Redirector">
   <param name="url">Accessibility</param>
   <param name="arg.someArg">$maps.drilldown$</param>
</module>

As far as what to do in the target view, to use this argument in one or more places, it's quite well explained in the Sideview Utils documentation, but basically you have a URLLoader at the top of the view,

and if we had passed the key over to the target view using the name someArg, then anywhere downstream from the URLLoader you would simply reference that key in one or more Sideview Search modules as $someArg$, and you can plug it into as many different Searches as you wish.

This is also explained in the docs, but getting that key to also prepopulate a Pulldown or TextField or Checkbox module in that target page is very simple - you just make sure there's a URLLoader there at the top of the view, and you just have the arg names match the module's "name" param exactly. So if you had a TextField module whose "name" param was "someArg", it would prepopulate itself to that $maps.drilldown$ key when the page loaded.

0 Karma

sideview
SplunkTrust
SplunkTrust

Looking back at your question I may have read too much into your use of the word "redirector" - thinking you were asking about the Sideview Redirector module. At any rate with just the core modules this is a little weird. You'd have to use the SimpleDrilldown module, which isn't very well documented, http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModuleReference#SimpleDrilldown and then in the target view you'd have to use the trickier core modules like ExtendedFieldSearch or SearchSelectLister, along with the right stringreplace intentions config.

0 Karma

sideview
SplunkTrust
SplunkTrust

So, use <param name="drilldown_field">CODE</param> in the GoogleMaps module, and then as I said the $maps.drilldown$ key, downstream from the GoogleMaps module, will have a value like ( CODE="someValue" OR CODE="someOtherValue" OR CODE="someThirdValue" ) and so on and so forth. You would then pass that value to the target view as I mentioned with the Redirector module. Dont use addterm or stringreplace or ConvertToIntention or any of that. Put literally just the 4 lines of XML with the Redirector module, downstream from your GoogleMaps module and that's it.

0 Karma

Aakanksha
Path Finder

I am still not able to resolve it. I am plotting locations on Google map, and its corresponding csv file contains three column - LAT,LONG,CODE.
Search String is - sourcetype="csv-2" |eval _geo=geo_lat+","+geo_lng

According to my dashboard requirement i want to drilldown CODE and on clicking any of the _geo location the linking dashboard(say ACCESSIBILITY) should get open with parameter CODE replaced/appended(replaceString/addterm) in the search string of this new dashboard(ACCESSIBILITY).
How this can be done?
Thanks in anticipation.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...