Splunk Search

How to drilldown from a custom module

achung12
Explorer

I have a custom module that receives search results from an ancestor module and would like to do a drilldown when the user does something, either pass some search terms to a HiddenSearch or dispatch a search itself. How do I go about doing that? It inherits DispatchingModule.

I've looked at SimpleResultsTable as an example and at the part where it seems to handle a drilldown click it does:

this.showDescendants(this.DRILLDOWN_VISIBILITY_KEY + "_" + this.moduleId);

this._selection = this.getSelectionState(evt);

this.pushContextToChildren();

And HiddenSearch does something with contexts as well:

var context = this.getContext();

var search = context.get("search");

...

context.set("search", search);

return context;

I'm not sure what any of the context stuff really means... Any help would be appreciated.

Thanks!

1 Solution

sideview
SplunkTrust
SplunkTrust

If you havent already (and quite possibly you have) you should download the 'ui examples' app from splunkbase and read the first few 'intro' views under 'advanced xml'.

the code in individual modules doesnt actually dispatch any searches ever. All it does is 'push' the data it has to downstream modules.

You should read this answer, but you can skip down to the part that starts with "The trickiest thing to understand":

http://splunk-base.splunk.com/answers/28176/multiple-searches-with-single-parameter-in-advanced-view...

OK. once you've read that, then calling 'pushContextToChildren()' will push data to the module's children. As you now know (from reading that other answer) any searches that need to get kicked off will get kicked off automatically just from you having 'pushed' data downstream and you dont have to worry about them.

If you want your module to add new 'stuff' for downstream modules, you do that by implementing getModifiedContext(), like so

getModifiedContext: function() {
    // this is everything that your ancestor modules have given you. 
    var context = this.getContext();

    // the key I want downstream modules to get,  and its value 
    context.set("mySpecialKey",  "someValue")

    return context;
}

So while calling 'pushContextToChildren' starts the push at the correct time, it is the implementation of getModifiedContext() that determines what will be pushed downstream.

View solution in original post

sideview
SplunkTrust
SplunkTrust

If you havent already (and quite possibly you have) you should download the 'ui examples' app from splunkbase and read the first few 'intro' views under 'advanced xml'.

the code in individual modules doesnt actually dispatch any searches ever. All it does is 'push' the data it has to downstream modules.

You should read this answer, but you can skip down to the part that starts with "The trickiest thing to understand":

http://splunk-base.splunk.com/answers/28176/multiple-searches-with-single-parameter-in-advanced-view...

OK. once you've read that, then calling 'pushContextToChildren()' will push data to the module's children. As you now know (from reading that other answer) any searches that need to get kicked off will get kicked off automatically just from you having 'pushed' data downstream and you dont have to worry about them.

If you want your module to add new 'stuff' for downstream modules, you do that by implementing getModifiedContext(), like so

getModifiedContext: function() {
    // this is everything that your ancestor modules have given you. 
    var context = this.getContext();

    // the key I want downstream modules to get,  and its value 
    context.set("mySpecialKey",  "someValue")

    return context;
}

So while calling 'pushContextToChildren' starts the push at the correct time, it is the implementation of getModifiedContext() that determines what will be pushed downstream.

achung12
Explorer

Thanks for the great answer! I tried it and it works perfectly. (I have used UI Examples -- helped me understand intentions and other fancy things)

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...