Splunk Search

Display custom search after click on SimpleResultsTable

Srw12
Explorer

I am having a SimpleResultsTable which allows to collect all information what I need.

Whereas, I would like to change the search behaviour after a click.

For example, when I click on some information, I have this search

  • sourcetype=LogSourceType name="test" value="100" error="warning"

But if I add a specific field to the current search, I would like to remove all other information.

For example, if I click on the field "id", i'll have this search

  • sourcetype=LogSourceType id="123"

I need to modify the javascript ? Or an existing module manages this functionality ?

Thanks in advance

0 Karma
1 Solution

Srw12
Explorer

Hi,

I've found a solution. It consist to change the javascript (FieldSearch.js) where the method setInputField: function(searchStr) is declared. I've added a conditional test, and it works perfectly.

View solution in original post

0 Karma

Srw12
Explorer

Hi,

I've found a solution. It consist to change the javascript (FieldSearch.js) where the method setInputField: function(searchStr) is declared. I've added a conditional test, and it works perfectly.

0 Karma

MHibbin
Influencer

Hi Srw12,

I believe the solution should be a lot simpler, you should look at creating a drilldown with a new HiddenSearch fed into it, using the $click.value$ value...

something like this (code needs modifying, just as an overview)

<module name="HiddenSearch">
  ...
  <module name="SimpleResultsTable">
    ...
    <module name="ConvertToDrilldownSearch">
      <module name="HiddenSearch">
        <param name="search">sourcetype=LogSourceType</param>
        <module name="ConvertToIntention">
          <param name="intention">
            <param name="name">addterm</param>
            <param name="arg">
              <param name="id">$click.value$</param>
            </param>
          </param>
          <module name="ViewRedirector">
            <param name="viewTarget">flashtimeline</param>
          </module>
        ...

Remember to close all of your open tags in the XML, hopefully this should give you a better idea... there is also some docs on this (here), I know you are able to do more advance drilldowns with Sideview Utils, but I have not used this myself.

Srw12
Explorer

Thanks for your reply. I've tried your solution, but the result doesn't match my expectation.
But I've a new question, is it possible to reset the search after a click ?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...