Reporting

Sideview Saved Search

ccsfdave
Builder

You may remember this from a few weeks ago, I a pulling in RSS and taking the link and making it the link to the title of the RSS article:

<module name="Search" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="search">source="rss" link="*symantec*" |dedup link |table title link|head 10</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>

I would like to turn it into a saved search with the same sideview functionality. Is it as simple as changing to a SavedSearch module name and the title of the search for a param?

Thanks!

Tags (2)
0 Karma
1 Solution

ccsfdave
Builder

Well, I should have tinkered before asking. This works like a charm:

      <module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="savedSearch">Symantec RSS</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>

View solution in original post

0 Karma

ccsfdave
Builder

Well, I should have tinkered before asking. This works like a charm:

      <module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="savedSearch">Symantec RSS</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>
0 Karma

ccsfdave
Builder

You have screencasts? Do share!!!

0 Karma

sideview
SplunkTrust
SplunkTrust

Yep - you can mix and match to the extent you want. I wouldn't use modules like ExtendedFieldSearch or SearchSelectLister, where the Sideview module is a vast improvement of course. I need to record another screencast to clarify which core modules are still useful - TimeRangePicker, SearchBar, JobProgressIndicator, JSChart and a couple more. But there's really nothing wrong with HiddenSavedSearch if you're not using Sideview-style report-saving.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...