Splunk Search

Display custom search after click on SimpleResultsTable

Srw12
Explorer

I am having a SimpleResultsTable which allows to collect all information what I need.

Whereas, I would like to change the search behaviour after a click.

For example, when I click on some information, I have this search

  • sourcetype=LogSourceType name="test" value="100" error="warning"

But if I add a specific field to the current search, I would like to remove all other information.

For example, if I click on the field "id", i'll have this search

  • sourcetype=LogSourceType id="123"

I need to modify the javascript ? Or an existing module manages this functionality ?

Thanks in advance

0 Karma
1 Solution

Srw12
Explorer

Hi,

I've found a solution. It consist to change the javascript (FieldSearch.js) where the method setInputField: function(searchStr) is declared. I've added a conditional test, and it works perfectly.

View solution in original post

0 Karma

Srw12
Explorer

Hi,

I've found a solution. It consist to change the javascript (FieldSearch.js) where the method setInputField: function(searchStr) is declared. I've added a conditional test, and it works perfectly.

0 Karma

MHibbin
Influencer

Hi Srw12,

I believe the solution should be a lot simpler, you should look at creating a drilldown with a new HiddenSearch fed into it, using the $click.value$ value...

something like this (code needs modifying, just as an overview)

<module name="HiddenSearch">
  ...
  <module name="SimpleResultsTable">
    ...
    <module name="ConvertToDrilldownSearch">
      <module name="HiddenSearch">
        <param name="search">sourcetype=LogSourceType</param>
        <module name="ConvertToIntention">
          <param name="intention">
            <param name="name">addterm</param>
            <param name="arg">
              <param name="id">$click.value$</param>
            </param>
          </param>
          <module name="ViewRedirector">
            <param name="viewTarget">flashtimeline</param>
          </module>
        ...

Remember to close all of your open tags in the XML, hopefully this should give you a better idea... there is also some docs on this (here), I know you are able to do more advance drilldowns with Sideview Utils, but I have not used this myself.

Srw12
Explorer

Thanks for your reply. I've tried your solution, but the result doesn't match my expectation.
But I've a new question, is it possible to reset the search after a click ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...