Security

Passing variables to views using URL query string params

Engager

I am trying to do something like this:

I want to define a view that can take for eg, start date and end date that the user can pass and then render a chart/graph for the data in that date range. I am trying to pass these start and end date values to the view from an external application so I want to pass these using URL query string parameters to the view. Is there a way to achieve this using Splunk.

Thanks a lot for your help.

Regards,
-Raj

Tags (1)

Engager

Hi Joe, Thanks a lot for the quick response. Is Sideview utils app a freeware? Is this part of Splunk or a third party add-on on top of Splunk?

I was exploring the Sideview utils app little bit but I wasnt sure what the licensing etc, was.

Thanks,
-Raj

0 Karma

Builder

It's free to download under the lesser gpl license. Review the license yourself and consult your legal department if you have questions. It's just a splunk app you can download from splunkbase. The app itself has a built in tutorial that explains the usage of all the new modules.

0 Karma

Builder

This is possible, especially if you use the sideview utils modules. Essentially you are going make a form search, using textfield modules, where the user would input values for earliest and latest time. You will then make use of the URLLoader module to pass down your arguments from the URL into the dashboard to populate those fields. The url that loads the view will end up looking something like this:

https://<localhost>/en-US/app/<yourapp>/<yourviewname>/earliest=<yourvalue>&latest=<yourvalue>;

I highly recommend walking through all the examples in the sideview utils app. It makes developing these advanced views a lot quicker and easier.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!