topic Re: sideview utils doing strange stuff with fields in All Apps and Add-ons

sideview utils doing strange stuff with fields

brettcave — Fri, 08 Mar 2013 13:23:35 GMT

I am struggling with getting the relevant fields through sideview utils.

I initially had a TextField with a button as child, and a search as a child to that. I then use the textfield as a filter in the base search, which has PostProcess sub-modules. I've now removed all post process modules.

My search consists of a handful of a series of evals followed by a stats followed by more more evals.

... | stats latest(SomeField) as SomeField latest(OtherField) as OtherField | eval SomeField="$".round(SomeField) | eval OtherField=round(OtherField)."%" | table SomeField OtherField | rename SomeField AS "Some Field Header" OtherField AS "Other Field Header"

relatively straight-forward, I would think. But when I run this search, I get random results. My evals aren't processed in some places.

There's about 10 fields, and of those, some are rounded, some aren't, some have the formatting done, some don't.

what is happening, why is sideview so unreliable in terms of results??

Re: sideview utils doing strange stuff with fields

martin_mueller — Fri, 08 Mar 2013 13:28:02 GMT

Are the results reliable when you run the search manually?

Re: sideview utils doing strange stuff with fields

brettcave — Fri, 08 Mar 2013 13:40:01 GMT

Well yes and no. I added an HTML module with $search$ in it so I can debug the search. When I do this, the original search that I configured the view with is being modified. So in the Splunk manager, the search has 4 evals, looking at the value of $search$, there's only 1 - for some reason, the configured search is being reduced. A copy and past of the search yields the same results as the sideview, but it's not how the view is configured.

Re: sideview utils doing strange stuff with fields

brettcave — Fri, 08 Mar 2013 13:46:31 GMT

Here's the (simplified) search configuration that I have:

| eval lastLogin=strftime(lastLogin,"%F %T") 
| eval regDate=strftime(RegTime,"%F %T")
| eval value="$".round(value) 
| table regDate numLogins lastLogin value numAccnts

This is what I see in the debug:

| eval lastLogin=strftime(lastLogin,"%F %T") | eval regDate=strftime(RegTime,"%F %T") | eval value="".round(IDAvg) | table regDate numLogins lastLogin value numAccnts

So value="$".round(value) becomes value="".round(IDAvg). Something to do with the $ perhaps? I use IDAvg, just removed it for the e.g.

Re: sideview utils doing strange stuff with fields

brettcave — Fri, 08 Mar 2013 13:48:50 GMT

yep - all my problems disappeared when i remove the "$". from the eval statements. Looks like sideview was trying to interpret those as variables I guess. I also tried escaping the dollar signs but didn't work. How would I go about using ... | eval DollarField="$".round(DollarField) in sideview?

Re: sideview utils doing strange stuff with fields

brettcave — Fri, 08 Mar 2013 13:51:45 GMT

The error was being caused by an ... | eval X="$".X in the search / PostProcess. Sideview Utils interprets this as a variable.

Now just need to figure out how to format currency using a different approach.

Re: sideview utils doing strange stuff with fields

martin_mueller — Fri, 08 Mar 2013 13:52:43 GMT

Give

$$

a try.

Re: sideview utils doing strange stuff with fields

sideview — Fri, 08 Mar 2013 18:08:48 GMT

See the doummentation about using $$ to escape literal $ characters. Admittedly you have to actually read the core documentation and come across it - there is no page saying "what if i want to use a dollar sign".

But if you go to "Key Techniques > Embedding dynamic values into your own HTML > Embedding HTML and including $foo$ values", there is a panel that talks about exactly this, titled "what if i want to use an actual dollar sign character?"

And reading the core documentation is a good thing to do. There is all kinds of useful information and best-practice stuff in there that will save you a great deal of time in future if you spend a little time reading it now.

Re: sideview utils doing strange stuff with fields

brettcave — Mon, 11 Mar 2013 07:56:17 GMT

yeah - i worked through about half the docs and examples, was trying to get a report done under a bit of a time constraint so dove in without finishing the examples. will continue working through docs and examples this week.

Re: sideview utils doing strange stuff with fields

sideview — Mon, 11 Mar 2013 18:06:07 GMT

Then you're more diligent than most. 😃 Keep going - I know from experience that time reading the docs pays a huge ongoing dividend. Which is the only reason I harp on it to the point of being annoying. Possibly past it.

Re: sideview utils doing strange stuff with fields

martin_mueller — Mon, 11 Mar 2013 19:42:34 GMT

That, on both counts 😛