Splunk Search

How to drilldown from a custom module

achung12
Explorer

I have a custom module that receives search results from an ancestor module and would like to do a drilldown when the user does something, either pass some search terms to a HiddenSearch or dispatch a search itself. How do I go about doing that? It inherits DispatchingModule.

I've looked at SimpleResultsTable as an example and at the part where it seems to handle a drilldown click it does:

this.showDescendants(this.DRILLDOWN_VISIBILITY_KEY + "_" + this.moduleId);

this._selection = this.getSelectionState(evt);

this.pushContextToChildren();

And HiddenSearch does something with contexts as well:

var context = this.getContext();

var search = context.get("search");

...

context.set("search", search);

return context;

I'm not sure what any of the context stuff really means... Any help would be appreciated.

Thanks!

1 Solution

sideview
SplunkTrust
SplunkTrust

If you havent already (and quite possibly you have) you should download the 'ui examples' app from splunkbase and read the first few 'intro' views under 'advanced xml'.

the code in individual modules doesnt actually dispatch any searches ever. All it does is 'push' the data it has to downstream modules.

You should read this answer, but you can skip down to the part that starts with "The trickiest thing to understand":

http://splunk-base.splunk.com/answers/28176/multiple-searches-with-single-parameter-in-advanced-view...

OK. once you've read that, then calling 'pushContextToChildren()' will push data to the module's children. As you now know (from reading that other answer) any searches that need to get kicked off will get kicked off automatically just from you having 'pushed' data downstream and you dont have to worry about them.

If you want your module to add new 'stuff' for downstream modules, you do that by implementing getModifiedContext(), like so

getModifiedContext: function() {
    // this is everything that your ancestor modules have given you. 
    var context = this.getContext();

    // the key I want downstream modules to get,  and its value 
    context.set("mySpecialKey",  "someValue")

    return context;
}

So while calling 'pushContextToChildren' starts the push at the correct time, it is the implementation of getModifiedContext() that determines what will be pushed downstream.

View solution in original post

sideview
SplunkTrust
SplunkTrust

If you havent already (and quite possibly you have) you should download the 'ui examples' app from splunkbase and read the first few 'intro' views under 'advanced xml'.

the code in individual modules doesnt actually dispatch any searches ever. All it does is 'push' the data it has to downstream modules.

You should read this answer, but you can skip down to the part that starts with "The trickiest thing to understand":

http://splunk-base.splunk.com/answers/28176/multiple-searches-with-single-parameter-in-advanced-view...

OK. once you've read that, then calling 'pushContextToChildren()' will push data to the module's children. As you now know (from reading that other answer) any searches that need to get kicked off will get kicked off automatically just from you having 'pushed' data downstream and you dont have to worry about them.

If you want your module to add new 'stuff' for downstream modules, you do that by implementing getModifiedContext(), like so

getModifiedContext: function() {
    // this is everything that your ancestor modules have given you. 
    var context = this.getContext();

    // the key I want downstream modules to get,  and its value 
    context.set("mySpecialKey",  "someValue")

    return context;
}

So while calling 'pushContextToChildren' starts the push at the correct time, it is the implementation of getModifiedContext() that determines what will be pushed downstream.

achung12
Explorer

Thanks for the great answer! I tried it and it works perfectly. (I have used UI Examples -- helped me understand intentions and other fancy things)

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...