Dashboards & Visualizations

SubmitButton Redirect Question

Ant1D
Motivator

Hey,

I am trying to do something and I cannot get it to work so here goes:

I have a form written in advanced XML that contains a SubmitButton. This form contains an ExtendedfieldSearch (text box) called Name.

When I click on the SubmitButton, I want it to take me to another view where another search is run and the text inside the Name text box is used to fill "..." in this search where it says:

search Name="..."

Any ideas of how I can use the data that the user enters in a text box as an argument in another search?

Thanks in advance for your help.

1 Solution

sideview
SplunkTrust
SplunkTrust

Splunk has a module called ViewRedirector, but the bad news is that it can really only pass a single argument that is either the raw searchstring, or a search id (the id of the underlying search job).

And although it can take other params like

<param name="uriParam.user">bob</param>

and although you might have the sensible hope then that it would then support dynamic arguments like so:

<param name="uriParam.user">$user$</param>

Unfortunately it does not. Adding to the problem, even if it did there is neither a module nor a piece of the framework that could load the "?user=bob" argument in the second view properly. And the 'lister' modules and other form search modules are incapable of prepopulating themselves from such data even if that data had been loaded properly.

This is one of the places where the decisions we made while building 4.0 don't look particularly rational (I think we were all working too hard at the time). At any rate since leaving Splunk I've made a number of custom modules to patch and improve areas like this, and for example I have created and repeatedly used custom modules that fix all 3 of the above problems. When 4.1.6 is out I'll be putting most or all of them up under a kind of 'sideview toolkit' app. But email me at nick [at] sideviewapps.com if you're interested in seeing them sooner than that. I do some consulting around Splunk on the side as well if you're interested in some hours of help integrating or troubleshooting particular views.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Splunk has a module called ViewRedirector, but the bad news is that it can really only pass a single argument that is either the raw searchstring, or a search id (the id of the underlying search job).

And although it can take other params like

<param name="uriParam.user">bob</param>

and although you might have the sensible hope then that it would then support dynamic arguments like so:

<param name="uriParam.user">$user$</param>

Unfortunately it does not. Adding to the problem, even if it did there is neither a module nor a piece of the framework that could load the "?user=bob" argument in the second view properly. And the 'lister' modules and other form search modules are incapable of prepopulating themselves from such data even if that data had been loaded properly.

This is one of the places where the decisions we made while building 4.0 don't look particularly rational (I think we were all working too hard at the time). At any rate since leaving Splunk I've made a number of custom modules to patch and improve areas like this, and for example I have created and repeatedly used custom modules that fix all 3 of the above problems. When 4.1.6 is out I'll be putting most or all of them up under a kind of 'sideview toolkit' app. But email me at nick [at] sideviewapps.com if you're interested in seeing them sooner than that. I do some consulting around Splunk on the side as well if you're interested in some hours of help integrating or troubleshooting particular views.

Ant1D
Motivator

Thank you for your response Nick. It's disappointing to not have this functionality but I will see if there is a way of working around this 🙂 I might just email you some time soon.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games     Think you have what it takes to beat the clock? ...