Reporting

Sideview Saved Search

ccsfdave
Builder

You may remember this from a few weeks ago, I a pulling in RSS and taking the link and making it the link to the title of the RSS article:

<module name="Search" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="search">source="rss" link="*symantec*" |dedup link |table title link|head 10</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>

I would like to turn it into a saved search with the same sideview functionality. Is it as simple as changing to a SavedSearch module name and the title of the search for a param?

Thanks!

Tags (2)
0 Karma
1 Solution

ccsfdave
Builder

Well, I should have tinkered before asking. This works like a charm:

      <module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="savedSearch">Symantec RSS</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>

View solution in original post

0 Karma

ccsfdave
Builder

Well, I should have tinkered before asking. This works like a charm:

      <module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="savedSearch">Symantec RSS</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>
0 Karma

ccsfdave
Builder

You have screencasts? Do share!!!

0 Karma

sideview
SplunkTrust
SplunkTrust

Yep - you can mix and match to the extent you want. I wouldn't use modules like ExtendedFieldSearch or SearchSelectLister, where the Sideview module is a vast improvement of course. I need to record another screencast to clarify which core modules are still useful - TimeRangePicker, SearchBar, JobProgressIndicator, JSChart and a couple more. But there's really nothing wrong with HiddenSavedSearch if you're not using Sideview-style report-saving.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Splunk Observability Metrics Cost Optimization

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...