Dashboards & Visualizations

Advanced XML: Drilldown to IFrameInclude

ayme
Splunk Employee
Splunk Employee

Hi guys,

Within Advanced XML, I'm trying to see if there is a way of configuring a drilldown to an IFrameInclude passing a URL parameter returned within a search. The URL is an external URL.

I've tried about a hundred different things with no success so far.

<module name="HiddenSavedSearch" layoutPanel="panel_row1_col2" group="Recommended Links" autoRun="True">
<param name="savedSearch">linked_in_recommended_links</param>
<param name="groupLabel">Recommended Links</param>
<module name="ViewstateAdapter">
  <param name="savedSearch">linked_in_recommended_links</param>
  <module name="HiddenFieldPicker">
    <param name="strictMode">True</param>
    <module name="JobProgressIndicator">
      <module name="EnablePreview">
        <param name="enable">True</param>
        <param name="display">False</param>
        <module name="SimpleResultsTable">
          <param name="drilldown">row</param>
          <param name="allowTransformedFieldSelect">True</param>
          <module name="ConvertToIntention">
            <param name="settingToConvert">series_setting</param> 
            <param name="intention">
              <param name="name">stringreplace</param>
              <param name="arg"> 
                <param name="url">
                 <param name="value">$target$</param>
                </param>
              </param> 
            </param>
           <module name="IFrameInclude" layoutPanel="panel_row2_col1">
              <param name="src">$url$</param>
              <param name="check_exists">True</param>
              <param name="height">1090</param>
           </module>
         </module>
        </module>
      </module>
    </module>
  </module>
</module>

Anyone know if this is possible?

Cheers.

Tags (2)

sideview
SplunkTrust
SplunkTrust

Since my original answer there's a better answer. Check out the Sideview Utils app, which I have been developing and releasing on Splunkbase. This app introduces a number of new custom modules. Among those is an HTML module, and like all of the Sideview modules it is pretty generous in allowing $foo$ substitution anywhere.

So you can have an <iframe> tag in your html, and just put src="$someToken$". Pretty straightforward really. And check out the view called "The Freshmaker" (http://<your host and port>/en-US/app/sideview_utils/refresh_entities, where I do exactly this. It has links as well as a Pulldown and a SubmitButton on the left side and an iframe on the right side.

Clicking the links loads pages in the iframe just courtesy of the target attribute, but clicking the SubmitButton pushes the currently selected value of the Pulldown into the iframe courtesy of the src="$entity$" that you'll see in its XML source.

0 Karma

sideview
SplunkTrust
SplunkTrust

Not out of the box, no. IFrameInclude does not pay attention to any dynamic data coming from modules upstream. Although the $foo$ syntax is extremely intuitive, only a few modules actually support anything there.

The good news is that it's relatively easy to augment module behavior from your app's application.js file.

if you put this code into /etc/apps//appserver/static/application.js it should do what you need.

if (Splunk.util.getCurrentView() == "my_view_name") {

    if (Splunk.Module.IFrameInclude) {
        Splunk.Module.IFrameInclude = $.klass(Splunk.Module.IFrameInclude, {
            onContextChange: function() {
                var context = this.getContext();
                var url = context.get("url")
                var iframeWindow = this.iframe[0].attr("src", url);
            }
        });
    }
}

Check out the 'discover' app on splunkbase, which uses this technique and others all over the place to fill in missing pieces and create advanced functionality.

In particular I augmented some modules so that they would do $foo$ replacement on their params, like you've tried here.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...