All Apps and Add-ons

drilldown from a hidden column

kkalmbach
Path Finder

In a dashboard, I have a SimpleResultsTable with a drilldown that uses:

<module name="SimpleResultsTable">                                            
  <param name="drilldown">row</param>
  <module name="Redirector">
         <param name="url">next_page</param>
         <param name="arg.key">$click.fields.key$</param>
  </module>
...

In this case "key" is a unique key that will determine the next_page's search.

The problem is that I would like key to not display in the results table (just be available for the drilldown). The value of "key" is not anything a user should ever see.

Is there anyway to add that field to the table but hide the column, or anything else that will make this possible.

Thanks

-Kevin

1 Solution

ziegfried
Influencer

Editor's note: please see next answer down for modern, Splunk 6.x+ method of doing this

--

When drilldown is set to row, the module uses the value in the first column of each row as drilldown value. So you can put the field you want to hide in the first column and then hide it using some Javascript in application.js.

Example:

if(Splunk.util.getCurrentView() == "myview") {
    Splunk.Module.SimpleResultsTable = $.klass(Splunk.Module.SimpleResultsTable, {
        renderResults: function($super,data) {
            $super(data);
            $('td:nth-child(2),th:nth-child(2)', this.container).hide();
        }
    });
}

View solution in original post

Jason
Motivator

If you are using Splunk 6.0+, with its redesigned UI, it is more simple to do a drilldown based on a hidden column.

In the SimpleXML dashboard, specify which fields should be displayed in the table as such:

Splunk 6.0-6.4.x

<option name="fields">field1,field2,field4,count</option>

Splunk 6.5+

<fields>field1,field2,field4,count</fields>

The other fields, including field3 (output by the search but not listed in the option above) will still be available to the drilldown as $row.field3$.

santosh_sshanbh
Path Finder

This helped me to hide a column from a table

0 Karma

samuelmah
New Member

Is there anyway for "fields" to take a variable? I want to be able to show/hide columns from a user option.

*somehow when I specify fields with "<" and ">" it gets removed from the comments. :s

0 Karma

Jodge
Path Finder

As of Splunk 6.5 the option "fields" has been deprecated.

So, instead now it is just:

<fields>field1,field2,field4,count</fields>

And exactly as before field3 will still be available to the drilldown as $row.field3$.

0 Karma

Jason
Motivator

Yes, thanks, just noticed that - though <option name="fields"> still works, it will be flagged as deprecated by the nice new xml editor. Updated post.

0 Karma

cwb2
Engager

This worked great for me. Thanks!

0 Karma

sideview
SplunkTrust
SplunkTrust

If you're using a recent version of Sideview Utils, you can use the Table module instead of Splunk's SimpleResultsTable module.

This get you a couple big benefits. First of all, at least for you, is that it has a "hiddenFields" param, which you can use to have field values present in the data, available for drilldowns, but not actually rendered in the table columns.

Secondly, you can use $row.fields.myFieldName$ and $row.fields.someOtherFieldName$ to refer to the field values in the given selected row.

Note that it's "row" instead of SimpleResultsTable's "click". There's a good reason for this name change and it'll make more sense as you use the Table module more. You can always change it away from "row" if you like just by setting the Table module's optional "name" param.

There are several pages of documentation within the Sideview Utils app itself that will tell you all you need to know about the Table module and how to use it.

1) Download the latest version of Sideview Utils (2.2.10) from the Sideview site at http://sideviewapps.com/apps/sideview-utils. Note that if you think you have the app already you probably have the old version from Splunkbase (1.3.5).

2) Install the app, navigate to it and then navigate to "Module Documentation > The Table Module" and go from there. There are several pages and the hiddenFields stuff is pretty early on.

pamcarvalho
Path Finder

Hey! I was wondering if this still works, I really need to drilldown values from a hidden field and not sure how to do so

0 Karma

Jason
Motivator

See my answer above, and the comments beneath it.

0 Karma

ziegfried
Influencer

Editor's note: please see next answer down for modern, Splunk 6.x+ method of doing this

--

When drilldown is set to row, the module uses the value in the first column of each row as drilldown value. So you can put the field you want to hide in the first column and then hide it using some Javascript in application.js.

Example:

if(Splunk.util.getCurrentView() == "myview") {
    Splunk.Module.SimpleResultsTable = $.klass(Splunk.Module.SimpleResultsTable, {
        renderResults: function($super,data) {
            $super(data);
            $('td:nth-child(2),th:nth-child(2)', this.container).hide();
        }
    });
}

hexx
Splunk Employee
Splunk Employee

Very cool, just threw this into a couple of Splunk on Splunk views!

0 Karma

lanying
Explorer

Hi.
I have a same problem. So, I'm now apply the application.js and solve the problem. But field's name is not hide.
If the table have 4 fields - first field is hidden , 4 fields name , 3 data fields ard displayed.
Do you understand my question?

0 Karma

ziegfried
Influencer

Ah ok, I wasn't aware of this. Great enhancement btw 😉

0 Karma

sideview
SplunkTrust
SplunkTrust

Your first sentence is technically not true if you're using Sideview Utils. Using the $click.fields.fieldName$ syntax you can get the value for any field in the entire row. You're no longer limited to just the first field. Conversely, within core Splunk UI, the "first column" limitation absolutely applies.

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...