Splunk Search

How to drilldown from a custom module

achung12
Explorer

I have a custom module that receives search results from an ancestor module and would like to do a drilldown when the user does something, either pass some search terms to a HiddenSearch or dispatch a search itself. How do I go about doing that? It inherits DispatchingModule.

I've looked at SimpleResultsTable as an example and at the part where it seems to handle a drilldown click it does:

this.showDescendants(this.DRILLDOWN_VISIBILITY_KEY + "_" + this.moduleId);

this._selection = this.getSelectionState(evt);

this.pushContextToChildren();

And HiddenSearch does something with contexts as well:

var context = this.getContext();

var search = context.get("search");

...

context.set("search", search);

return context;

I'm not sure what any of the context stuff really means... Any help would be appreciated.

Thanks!

1 Solution

sideview
SplunkTrust
SplunkTrust

If you havent already (and quite possibly you have) you should download the 'ui examples' app from splunkbase and read the first few 'intro' views under 'advanced xml'.

the code in individual modules doesnt actually dispatch any searches ever. All it does is 'push' the data it has to downstream modules.

You should read this answer, but you can skip down to the part that starts with "The trickiest thing to understand":

http://splunk-base.splunk.com/answers/28176/multiple-searches-with-single-parameter-in-advanced-view...

OK. once you've read that, then calling 'pushContextToChildren()' will push data to the module's children. As you now know (from reading that other answer) any searches that need to get kicked off will get kicked off automatically just from you having 'pushed' data downstream and you dont have to worry about them.

If you want your module to add new 'stuff' for downstream modules, you do that by implementing getModifiedContext(), like so

getModifiedContext: function() {
    // this is everything that your ancestor modules have given you. 
    var context = this.getContext();

    // the key I want downstream modules to get,  and its value 
    context.set("mySpecialKey",  "someValue")

    return context;
}

So while calling 'pushContextToChildren' starts the push at the correct time, it is the implementation of getModifiedContext() that determines what will be pushed downstream.

View solution in original post

sideview
SplunkTrust
SplunkTrust

If you havent already (and quite possibly you have) you should download the 'ui examples' app from splunkbase and read the first few 'intro' views under 'advanced xml'.

the code in individual modules doesnt actually dispatch any searches ever. All it does is 'push' the data it has to downstream modules.

You should read this answer, but you can skip down to the part that starts with "The trickiest thing to understand":

http://splunk-base.splunk.com/answers/28176/multiple-searches-with-single-parameter-in-advanced-view...

OK. once you've read that, then calling 'pushContextToChildren()' will push data to the module's children. As you now know (from reading that other answer) any searches that need to get kicked off will get kicked off automatically just from you having 'pushed' data downstream and you dont have to worry about them.

If you want your module to add new 'stuff' for downstream modules, you do that by implementing getModifiedContext(), like so

getModifiedContext: function() {
    // this is everything that your ancestor modules have given you. 
    var context = this.getContext();

    // the key I want downstream modules to get,  and its value 
    context.set("mySpecialKey",  "someValue")

    return context;
}

So while calling 'pushContextToChildren' starts the push at the correct time, it is the implementation of getModifiedContext() that determines what will be pushed downstream.

achung12
Explorer

Thanks for the great answer! I tried it and it works perfectly. (I have used UI Examples -- helped me understand intentions and other fancy things)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...