Splunk Search

How to drilldown from a custom module

achung12
Explorer

I have a custom module that receives search results from an ancestor module and would like to do a drilldown when the user does something, either pass some search terms to a HiddenSearch or dispatch a search itself. How do I go about doing that? It inherits DispatchingModule.

I've looked at SimpleResultsTable as an example and at the part where it seems to handle a drilldown click it does:

this.showDescendants(this.DRILLDOWN_VISIBILITY_KEY + "_" + this.moduleId);

this._selection = this.getSelectionState(evt);

this.pushContextToChildren();

And HiddenSearch does something with contexts as well:

var context = this.getContext();

var search = context.get("search");

...

context.set("search", search);

return context;

I'm not sure what any of the context stuff really means... Any help would be appreciated.

Thanks!

1 Solution

sideview
SplunkTrust
SplunkTrust

If you havent already (and quite possibly you have) you should download the 'ui examples' app from splunkbase and read the first few 'intro' views under 'advanced xml'.

the code in individual modules doesnt actually dispatch any searches ever. All it does is 'push' the data it has to downstream modules.

You should read this answer, but you can skip down to the part that starts with "The trickiest thing to understand":

http://splunk-base.splunk.com/answers/28176/multiple-searches-with-single-parameter-in-advanced-view...

OK. once you've read that, then calling 'pushContextToChildren()' will push data to the module's children. As you now know (from reading that other answer) any searches that need to get kicked off will get kicked off automatically just from you having 'pushed' data downstream and you dont have to worry about them.

If you want your module to add new 'stuff' for downstream modules, you do that by implementing getModifiedContext(), like so

getModifiedContext: function() {
    // this is everything that your ancestor modules have given you. 
    var context = this.getContext();

    // the key I want downstream modules to get,  and its value 
    context.set("mySpecialKey",  "someValue")

    return context;
}

So while calling 'pushContextToChildren' starts the push at the correct time, it is the implementation of getModifiedContext() that determines what will be pushed downstream.

View solution in original post

sideview
SplunkTrust
SplunkTrust

If you havent already (and quite possibly you have) you should download the 'ui examples' app from splunkbase and read the first few 'intro' views under 'advanced xml'.

the code in individual modules doesnt actually dispatch any searches ever. All it does is 'push' the data it has to downstream modules.

You should read this answer, but you can skip down to the part that starts with "The trickiest thing to understand":

http://splunk-base.splunk.com/answers/28176/multiple-searches-with-single-parameter-in-advanced-view...

OK. once you've read that, then calling 'pushContextToChildren()' will push data to the module's children. As you now know (from reading that other answer) any searches that need to get kicked off will get kicked off automatically just from you having 'pushed' data downstream and you dont have to worry about them.

If you want your module to add new 'stuff' for downstream modules, you do that by implementing getModifiedContext(), like so

getModifiedContext: function() {
    // this is everything that your ancestor modules have given you. 
    var context = this.getContext();

    // the key I want downstream modules to get,  and its value 
    context.set("mySpecialKey",  "someValue")

    return context;
}

So while calling 'pushContextToChildren' starts the push at the correct time, it is the implementation of getModifiedContext() that determines what will be pushed downstream.

achung12
Explorer

Thanks for the great answer! I tried it and it works perfectly. (I have used UI Examples -- helped me understand intentions and other fancy things)

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...