Dashboards & Visualizations

Form search drill down action to set field value

blilburne
Explorer

I have a form search set up, with a field where the user can type in a term. The result of the form search is a bar chart of ten other correlating words.

I would like to change the action on clicking the bar to take you to the same form search, with the original typed word replaced with the word that was clicked on.

i.e - user searches for bar, sees a correlation list including baz and chux. Clicking baz starts a new search for baz, and they see correlations for baz (only, bar is no longer in the search)

It seems like this should be possible with the redirect actions but I get strange results when I try that.

Tags (2)

sideview
SplunkTrust
SplunkTrust

You should download Sideview Utils from Splunkbase. It will make this possible whereas without it you'd have to write a lot of somewhat hairy javascript to bypass the default splunk systems.

You'll want to read about the TextField module, cause that will replace your ExtendedFieldSearch module, and about the Redirector module which will replace your ViewRedirector module.

Most of all, read the section in the app 'General Techniques - linking'. The documentation there will put it all together for you.

The key piece will be having a Redirector module downstream from the Flashchart that looks like this. "your_text_field_name_here" must match whatever 'name' param you decided to give your TextField module, and "your_view_name_here" should just be the name of your view.

<module name="Redirector">
  <param name="url">your_view_name_here</param>
  <param name="arg.your_text_field_name_here">$click.value$</param> 
</module>

I'm skipping over some things, like what role the URLLoader module plays, but read the docs in the app and read through the examples and you'll be fine.

0 Karma

RicoSuave
Builder

Any chance you can post your code?

0 Karma

phoenixdigital
Builder

Did you ever find a solution to this?

I am trying to do something very similar but have no idea if it is even possible.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...