Reporting

Sideview Saved Search

ccsfdave
Builder

You may remember this from a few weeks ago, I a pulling in RSS and taking the link and making it the link to the title of the RSS article:

<module name="Search" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="search">source="rss" link="*symantec*" |dedup link |table title link|head 10</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>

I would like to turn it into a saved search with the same sideview functionality. Is it as simple as changing to a SavedSearch module name and the title of the search for a param?

Thanks!

Tags (2)
0 Karma
1 Solution

ccsfdave
Builder

Well, I should have tinkered before asking. This works like a charm:

      <module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="savedSearch">Symantec RSS</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>

View solution in original post

0 Karma

ccsfdave
Builder

Well, I should have tinkered before asking. This works like a charm:

      <module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="savedSearch">Symantec RSS</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>
0 Karma

ccsfdave
Builder

You have screencasts? Do share!!!

0 Karma

sideview
SplunkTrust
SplunkTrust

Yep - you can mix and match to the extent you want. I wouldn't use modules like ExtendedFieldSearch or SearchSelectLister, where the Sideview module is a vast improvement of course. I need to record another screencast to clarify which core modules are still useful - TimeRangePicker, SearchBar, JobProgressIndicator, JSChart and a couple more. But there's really nothing wrong with HiddenSavedSearch if you're not using Sideview-style report-saving.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...