When I search for a result I want to be able to select a single result and view it in a custom view i.e I search for "blank" and get 100 results. When I select a result from the results table I see a view with only the result I selected and information about this result.
Just wondering if this is possible using the advanced XML as I have never had to use XML before, any help or questions to explain the request more are welcomed
Thanks in advance
You may want to check out Sideview Utils. You can either get the older 1.3 version free from Splunkbase, or get a 90 day trial of the new 2.0 version from the Sideview site.
As for what the benefit is here for this use case, the short short version is that it's a lot more intuitive. a) you wont have to use intentions, or think about intentions, and b) you can use the Redirector module to pass the clicked value from the first view to the second view, and you can use that $myClickedUponRowValue$ token in the second view however you want.
For the long version, I'd pull down the app, either the newer or the older version, and then open the app in your browser. You'll see it has tons of documentation and examples. You should read through all of it, but there are several pages about these areas -- linking from view to view, prepopulating UI elements in the target view, and using the Redirector and URLLoader modules.
Yes, absolutely possible. This is off the top of my head, so excuse any typos or errors
<!-- This is the search you use to populate the table -->
This post has more information on the ConvertToIntention module:
Yes, take the code above and put it in a new view, either through Manager > User Interface > Views > New or by pasting it in to a file in
$SPLUNK_HOME/etc/apps/<your_app>/default/data/ui/views/. If you put a reference to it in
$SPLUNK_HOME/etc/apps/<your_app>/default/data/ui/nav/default.xml, it will show up in the nav bar.
Thanks for the response
Sorry for my complete beginner experience but your going to have to hold my hand a little here does this code that you have written go into it's own xml file in $Splunk\etc\apps<my app>\default\data\ui\views and then do I reference it in the $Splunk\etc\apps\Matt\default\data\ui\nav default.xml ???