Reporting

Sideview Saved Search

ccsfdave
Builder

You may remember this from a few weeks ago, I a pulling in RSS and taking the link and making it the link to the title of the RSS article:

<module name="Search" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="search">source="rss" link="*symantec*" |dedup link |table title link|head 10</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>

I would like to turn it into a saved search with the same sideview functionality. Is it as simple as changing to a SavedSearch module name and the title of the search for a param?

Thanks!

Tags (2)
0 Karma
1 Solution

ccsfdave
Builder

Well, I should have tinkered before asking. This works like a charm:

      <module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="savedSearch">Symantec RSS</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>

View solution in original post

0 Karma

ccsfdave
Builder

Well, I should have tinkered before asking. This works like a charm:

      <module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="savedSearch">Symantec RSS</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>
0 Karma

ccsfdave
Builder

You have screencasts? Do share!!!

0 Karma

sideview
SplunkTrust
SplunkTrust

Yep - you can mix and match to the extent you want. I wouldn't use modules like ExtendedFieldSearch or SearchSelectLister, where the Sideview module is a vast improvement of course. I need to record another screencast to clarify which core modules are still useful - TimeRangePicker, SearchBar, JobProgressIndicator, JSChart and a couple more. But there's really nothing wrong with HiddenSavedSearch if you're not using Sideview-style report-saving.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

July Community Events: Master ITSI 5.0 & Automate Splunk

Struggling with alert fatigue or feeling like you're spending more time on infrastructure maintenance than ...

New Release of Federated Search: Bringing Splunk Analytics to More of Your Data

Organizations today are generating more data than ever and storing it across cloud object stores, data lakes, ...