Splunk Search

Display custom search after click on SimpleResultsTable

Srw12
Explorer

I am having a SimpleResultsTable which allows to collect all information what I need.

Whereas, I would like to change the search behaviour after a click.

For example, when I click on some information, I have this search

  • sourcetype=LogSourceType name="test" value="100" error="warning"

But if I add a specific field to the current search, I would like to remove all other information.

For example, if I click on the field "id", i'll have this search

  • sourcetype=LogSourceType id="123"

I need to modify the javascript ? Or an existing module manages this functionality ?

Thanks in advance

0 Karma
1 Solution

Srw12
Explorer

Hi,

I've found a solution. It consist to change the javascript (FieldSearch.js) where the method setInputField: function(searchStr) is declared. I've added a conditional test, and it works perfectly.

View solution in original post

0 Karma

Srw12
Explorer

Hi,

I've found a solution. It consist to change the javascript (FieldSearch.js) where the method setInputField: function(searchStr) is declared. I've added a conditional test, and it works perfectly.

0 Karma

MHibbin
Influencer

Hi Srw12,

I believe the solution should be a lot simpler, you should look at creating a drilldown with a new HiddenSearch fed into it, using the $click.value$ value...

something like this (code needs modifying, just as an overview)

<module name="HiddenSearch">
  ...
  <module name="SimpleResultsTable">
    ...
    <module name="ConvertToDrilldownSearch">
      <module name="HiddenSearch">
        <param name="search">sourcetype=LogSourceType</param>
        <module name="ConvertToIntention">
          <param name="intention">
            <param name="name">addterm</param>
            <param name="arg">
              <param name="id">$click.value$</param>
            </param>
          </param>
          <module name="ViewRedirector">
            <param name="viewTarget">flashtimeline</param>
          </module>
        ...

Remember to close all of your open tags in the XML, hopefully this should give you a better idea... there is also some docs on this (here), I know you are able to do more advance drilldowns with Sideview Utils, but I have not used this myself.

Srw12
Explorer

Thanks for your reply. I've tried your solution, but the result doesn't match my expectation.
But I've a new question, is it possible to reset the search after a click ?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...