topic Re: Custom FlashTimeLine using Sideview Utils in All Apps and Add-ons

Custom FlashTimeLine using Sideview Utils

KarunK — Mon, 28 Sep 2020 12:09:07 GMT

Hi All,

I am making a custom flashtimeline dashboard with side-view util. The page loads perfectly, But i cannot search on it. Its dont do anything.

It will work once I remove
module="SuggestedFieldViewer"

Can't figure out the reason or any solution.

Can anyone please help ?

Thanks in Advance

<view autoCancelInterval="90" isPersistable="true" isSticky="false" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" stylesheet="custom.css" template="search.html">

Search

False
2

splunk.search.
True
1

False
true
True
true

True
All time

True

splunk.search.job
True
2

True
report_builder_define_data
report_builder_format_report

100%
95px

host sourcetype source

report_builder_format_report

pageControls
True
1

10
10

20
20

50
True
50

True
splIcon-events-list
True
independent

event
splIcon-events-list
events
Events List
events

event

events
10

True

5
True
5

10
10

20
20

50
50

100
100

200
200

All
0

inner
True
inner

outer
outer

full
full

raw
raw

full
report_builder_format_report

events
10

event
splIcon-events-table
events
Events Table
events

events

events
10

events

events
10

result
splIcon-results-table
results
Results Table
results

result

True
show

results
10

results
all

True
flashtimeline

results
10

Results Chart
splIcon-results-chart
independent
job && !job.isCanceled() && job.hasOwnProperty("_reportSearch") && !job.areResultsTransformed()

event
events
events

result
results
results

True
show

Formatting options
True
secondary
serializeAll

show
true

True
serializeAll
Format

General
Chart title

X-axis

Y-axis

100%
20
300px

flashtimeline

report_builder_format_report

`

Re: Custom FlashTimeLine using Sideview Utils

sideview — Thu, 26 Jul 2012 21:07:02 GMT

It's because of a bug in SuggestedFieldViewer. If you don't define the 'exclude' param, then it throws an exception. (It would be very easy to fix the bug so hopefully someone will notice this answer and file something to fix it).

In the meantime you can just be careful with the SuggestedFieldViewer params.
For instance here's the config that flashtimeline itself uses and if you replace your <module name="SuggestedFieldViewer" /> with this, it'll work.

<module name="SuggestedFieldViewer">
  <param name="minDistinctCount">1</param>
  <param name="minFrequency">0.5</param>
  <param name="maxFields">50</param>
  <param name="exclude">
  <list>^date_.*</list>
  </param>
  <param name="link">
  <param name="view">report_builder_format_report</param>
  </param>
</module>

Re: Custom FlashTimeLine using Sideview Utils

KarunK — Mon, 28 Sep 2020 12:09:32 GMT

Thanks for that. Really Appreciate that. It worked. But strangely I have tried the same params in different order. But didn't work. So the params has to be listed in the same order shown above.

Param listing order which DIDN'T WORKED is as below.

.......NOT WORKING......

50
1
0.5

report_builder_format_report

^date_.*

Re: Custom FlashTimeLine using Sideview Utils

therealdpk — Tue, 09 Oct 2012 02:17:38 GMT

Can you unmark this answer as accepted @KarunK?

I can confirm that this does not fix the problem. There does indeed seem to be a bug in SuggestedFieldViewer, but adding the exclude does not seem to make a difference.

Worth pointing out: the block that is not working is copied from flashtimeline's source. If you use simply:

^date_.*

you get a different error but params["exclude"] is indeed set. I have a feeling that is not fully supported by Splunk, but who knows.

Re: Custom FlashTimeLine using Sideview Utils

therealdpk — Tue, 09 Oct 2012 02:40:28 GMT

I found a really lame work-around. Replace the ... xml with just:

<param name="exclude">€</param>

The buggy javascript will try to use whatever you have between as an array, and JS will treat a string as an array so this basically gives it what it wants. I chose the euro symbol because it will never appear as one of my keys.

This solution means that you'll see date_ in the suggested field viewer. But eh.

Re: Custom FlashTimeLine using Sideview Utils

sideview — Tue, 09 Oct 2012 03:47:32 GMT

The problem is that you guys are using <item>. Note that <item> is not what I said in my answer and indeed <item> is not supported by the advanced XML. Replace it with <list> and you'll be fine.