Knowledge Management

how to pass value to another view and how to get it

john
Communicator

hi,

I want to pass value form driilldown to another view but its not working .Drill down redirecting to another view but in that view iam not able to get that value iam getting null value in that view. What could be the issue .Please help

this is what i have tried

My table looks like this:

value  id     _time      
abc    1       ...
hij    2
lll    3
000    4

1st view

<module name="HiddenSearch" layoutPanel="panel_row3_col1"  autoRun="True">
  <param name="search"><![CDATA[|search source="C:\\.\\..." |rex field=_raw "Id\s(?<Value>.*)\:\s"|table value,_time]]></param>    
  <module name="Paginator">
    <param name="entityName">events</param>
    <param name="maxPages">10</param>
    <param name="count">5</param>
    <module name="ResultsHeader">
      <param name="entityName">scanned</param>
      <param name="entityLabel">Events</param>
      <module name="SimpleResultsTable">
        <param name="count">100</param>
        <param name="displayMenu">True</param>
        <param name="drilldown">row</param>
        <param name="drilldownPrefix">click</param>
        <module name="ConvertToIntention">
          <param name="settingToConvert">errors_setting</param>
          <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
              <param name="errors">
                 <param name="value">$click.value$</param>
              </param>
            </param>
          </param>
          <module name="ViewRedirector">
            <param name="viewTarget">Sample_View</param>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

Sample_View

<view autoCancelInterval="90"  template="dashboard.html">
  <label>kl Dashboard</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="HiddenSearch"  layoutPanel="panel_row1_col1">
    <param name="search"> <![CDATA[|search source="C:\\...."  $click.value$| stats count as "Count" ]]>  </param>
    <module name="SingleValue">
      <param name="field">Count</param>
      <param name="afterLabel"> error</param>
    </module>
  </module>
</view>

iam trying to get the value which is coming under value and have written a serch on that in another view.

Tags (1)

sideview
SplunkTrust
SplunkTrust

If you're interested in giving yourself an easier way to do this, as well as to do many other things, you should check out Sideview Utils.

The 1.3.X version of Sideview Utils is available from Splunkbase under an LGPL license.

Then the 2.0 version of Sideview Utils is out, and although 2.0 is newer, better, and although you can get a 90 day trial from the Sideview Site, note that it's not a free product and it'll stop working after 90 days.

Anyway, with either the older or the new versions, this has been in Sideview Utils for a while and you can greatly simplify linking from page to page as follows:

Here's what your XML would look like if you switched. Note Search, HTML, Pager, Redirector and URLLoader are all Sideview modules that get loaded from Utils and that just fit in as available modules right along the core modules.

<module name="Search" layoutPanel="panel_row3_col1"  autoRun="True">
  <param name="search"><![CDATA[|search source="C:\\.\\..." |rex field=_raw "Id\s(?<Value>.*)\:\s"|table value,_time]]></param>    
  <module name="HTML">
    <param name="search"><![CDATA[
      $results.scanCount$ events $search.timeRange.label$
    ]]</param>
  </module>
  <module name="Pager">
    <param name="entityName">events</param>
    <param name="maxPages">10</param>
    <param name="count">5</param>
    <module name="SimpleResultsTable">
      <param name="drilldown">row</param>
      <module name="Redirector">
        <param name="url">nameOfMyTargetView</param>
        <param name="arg.myPassedValue">$click.value$</param>
      </module>
    </module>
  </module>
</module>

Then, if say the user clicks on a row where $click.value$ is "fred", the table clicks then send the user to `nameOfMyTargetView?myPassedValue=fred.

And the target view would just look like this. (Note that I've taken the liberty of replacing your SingleValue modules with simple HTML. If you don't like rolling your own CSS and customizing the look and feel, you may prefer to keep using SingleValue though).

<module name="URLLoader">
  <module name="Search">
    <param name="search"> <![CDATA[|search source="C:\\...."  $myPassedValue$| stats count as "Count" ]]>  </param>
    <module name="HTML">
    <param name="search"><![CDATA[
      $results[0].Count$
    ]]</param>
  </module>
</module>

Note that TONS more information, documentation and examples are available inside Sideview Utils.

araitz
Splunk Employee
Splunk Employee

You almost had it!

Keep in mind that you are passing a 'search string' (rather than a 'context', which contains things like 'click.value' and the intention to be string-replaced) to the second view. Therefore, you need to get the full search string in the first view before you pass it on to the second view.

Try something like this below the SimpleResultsTable in the first view:

<module name="HiddenSearch">
  <param name="search"><![CDATA[source="C:\\...."  $token$| stats count as "Count" ]]>
  <module name="ConvertToIntention">
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="token">
           <param name="value">$click.value$</param>
        </param>
      </param>
    </param>
    <module name="ViewRedirector">
      <param name="viewTarget">Sample_View</param>
    </module>
  </module>
</module>

The second view will receive the search string with the replacement already done, and will use this explicit search string in the view. Thus, you shouldn't need the HiddenSearch in the second view unless you intend on also using this same view in non-drilldown scenarios.

john
Communicator

Thanks nick.

0 Karma

sideview
SplunkTrust
SplunkTrust

Nope, in core splunk you can pass only one search and one timerange, rather than being able to pass 1-N general arguments. As far as I know everyone who needs to do this ends up downloading utils.

0 Karma

john
Communicator

Hi can v pass more than one hidden search to another view like count,Then chart, because that can also work for me.because i have tried to pass two seraches to the other view but it was not working

0 Karma

sideview
SplunkTrust
SplunkTrust

In Sideview Utils this is pretty easy -- you just have more than one subtree of modules in the target view, and you apply the $myPassedValue$ token however you want in each. With core Splunk it can be done, but it requires writing a fair bit of custom javascript. You can see for instance in the Deployment Monitor app I think there's a "forwarder detail" view in which the name of a splunk forwarder is passed, and then in that view, that forwarder name is applied to run more than one search and render different charts/tables/etc..

0 Karma

john
Communicator

I have tried this but i want to do searches in second view using the particular value which is getting from first view.i dont want to use that value in the first view and passing the result to another view.Using that value i want create dashboard having chart and other searches also in second view.

0 Karma

john
Communicator

actually i want the value which user clicked in drilldown to another view so that to write different searches on that particular value.Not simply showing the count alone but dashboard for other searches also.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...