Dashboards & Visualizations

SubmitButton Redirect Question

Ant1D
Motivator

Hey,

I am trying to do something and I cannot get it to work so here goes:

I have a form written in advanced XML that contains a SubmitButton. This form contains an ExtendedfieldSearch (text box) called Name.

When I click on the SubmitButton, I want it to take me to another view where another search is run and the text inside the Name text box is used to fill "..." in this search where it says:

search Name="..."

Any ideas of how I can use the data that the user enters in a text box as an argument in another search?

Thanks in advance for your help.

1 Solution

sideview
SplunkTrust
SplunkTrust

Splunk has a module called ViewRedirector, but the bad news is that it can really only pass a single argument that is either the raw searchstring, or a search id (the id of the underlying search job).

And although it can take other params like

<param name="uriParam.user">bob</param>

and although you might have the sensible hope then that it would then support dynamic arguments like so:

<param name="uriParam.user">$user$</param>

Unfortunately it does not. Adding to the problem, even if it did there is neither a module nor a piece of the framework that could load the "?user=bob" argument in the second view properly. And the 'lister' modules and other form search modules are incapable of prepopulating themselves from such data even if that data had been loaded properly.

This is one of the places where the decisions we made while building 4.0 don't look particularly rational (I think we were all working too hard at the time). At any rate since leaving Splunk I've made a number of custom modules to patch and improve areas like this, and for example I have created and repeatedly used custom modules that fix all 3 of the above problems. When 4.1.6 is out I'll be putting most or all of them up under a kind of 'sideview toolkit' app. But email me at nick [at] sideviewapps.com if you're interested in seeing them sooner than that. I do some consulting around Splunk on the side as well if you're interested in some hours of help integrating or troubleshooting particular views.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Splunk has a module called ViewRedirector, but the bad news is that it can really only pass a single argument that is either the raw searchstring, or a search id (the id of the underlying search job).

And although it can take other params like

<param name="uriParam.user">bob</param>

and although you might have the sensible hope then that it would then support dynamic arguments like so:

<param name="uriParam.user">$user$</param>

Unfortunately it does not. Adding to the problem, even if it did there is neither a module nor a piece of the framework that could load the "?user=bob" argument in the second view properly. And the 'lister' modules and other form search modules are incapable of prepopulating themselves from such data even if that data had been loaded properly.

This is one of the places where the decisions we made while building 4.0 don't look particularly rational (I think we were all working too hard at the time). At any rate since leaving Splunk I've made a number of custom modules to patch and improve areas like this, and for example I have created and repeatedly used custom modules that fix all 3 of the above problems. When 4.1.6 is out I'll be putting most or all of them up under a kind of 'sideview toolkit' app. But email me at nick [at] sideviewapps.com if you're interested in seeing them sooner than that. I do some consulting around Splunk on the side as well if you're interested in some hours of help integrating or troubleshooting particular views.

Ant1D
Motivator

Thank you for your response Nick. It's disappointing to not have this functionality but I will see if there is a way of working around this 🙂 I might just email you some time soon.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...