Getting Data In

Like to have list of files and content of selected file in one view.

Communicator

Hi there,

What I would really like, is creating a view, where I can select a (log)file, and shows the most recent content of that logfile right below, in a seperate panel.
I managed to create the list of logfiles, but as soon as I "click" on it, it opens a new view, even though I have set layoutPanel="panel_row2_col1" for the viewRedirector.

Oh my, trying to add a code snippet, but that doesn't work either. Wish I payed more attention in school. 🙂

Can anyone help me, since this shouldn't be too hard, right? 🙂

1 Solution

Splunk Employee
Splunk Employee

Take a look at this sample. Does a search for the sources, then uses the ShowSource on that source.

<module name="SearchSelectLister" layoutPanel="panel_row1_col1" group="viewsource" autoRun="True">
  <param name="search">index=_internal earliest=-15m | dedup source | table source</param>
  <param name="settingToCreate">source</param>
  <param name="searchFieldsToDisplay">
    <list>
      <param name="label">source</param>
      <param name="value">source</param>
    </list>
  </param>
  <module name="ConvertToIntention">
    <param name="settingToConvert">source</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="source">
          <param name="value">$target$</param>
        </param>
      </param>
    </param>
    <module name="HiddenSearch" layoutPanel="panel_row3_col1">
      <param name="search"> index=_internal source=$source$  </param>
      <module name="ShowSource"></module>
      <module name="ViewRedirectorLink">
          <param name="viewTarget">flashtimeline</param>
      </module>
    </module>
  </module>
</module>

View solution in original post

Splunk Employee
Splunk Employee

Take a look at this sample. Does a search for the sources, then uses the ShowSource on that source.

<module name="SearchSelectLister" layoutPanel="panel_row1_col1" group="viewsource" autoRun="True">
  <param name="search">index=_internal earliest=-15m | dedup source | table source</param>
  <param name="settingToCreate">source</param>
  <param name="searchFieldsToDisplay">
    <list>
      <param name="label">source</param>
      <param name="value">source</param>
    </list>
  </param>
  <module name="ConvertToIntention">
    <param name="settingToConvert">source</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="source">
          <param name="value">$target$</param>
        </param>
      </param>
    </param>
    <module name="HiddenSearch" layoutPanel="panel_row3_col1">
      <param name="search"> index=_internal source=$source$  </param>
      <module name="ShowSource"></module>
      <module name="ViewRedirectorLink">
          <param name="viewTarget">flashtimeline</param>
      </module>
    </module>
  </module>
</module>

View solution in original post

Legend

Did you check out the ui_examples app? It has loads of useful examples on things like drilldowns that you will want to read up on.