All Apps and Add-ons

Are "Module Groupings" in the future for Splunk and/or Sideview Utils?


What I mean by that is usually I end up stitching
together the same modules over and over. For example, Search, Job
Progress, Hidden Chart Formatter, JS Chart, Redirector.

It would begreat is somehow we could combine those modules in 1 "Grouping" so I
can add them all at once. I end up doing the same thing over and over again which after a whie becomes tedious and somewhat less productive.

0 Karma


Yep. In the land of Sideview Utils this is called "Patterns", and there has been some tinkering to implement this as a module called "Pattern". You would specify a pattern name and a couple arguments to that pattern, the pattern definition would be in your app somewhere, and ultimately the whole giant block of reusable form-element config or what-have-you would be reduced to a few lines.

There are a lot of technical hurdles in the way of doing it as a module, and it may end up coming into the world slightly differently - with Sideview Utils packaging it's own entirely standalone view controller, such that the URL in your browser as you moved from view to view would actually be

Yes if there were reusable patterns this would remove a huge amount of pain and frustration from splunk view development. That said, the off-the-shelf patterns that you would get out of the box would not be the big deal - rather it's the fact that all splunk deployments have some little block of shared Pulldown + TextField + TimeRangePicker + Button that they have to use over and over again.... Or some nutty looking SingleValue pattern with gauge stuff in it. Every deployment has its own little patterns it would want to define.

Anyway, the ability to have some extensible macro layer to just roll up complex view config into a "pattern" will be great.

And then from there, I could easily make the Sideview Editor operate at the Pattern layer as well as the raw-Module layer. So you can "add new pattern" and in the schematic view of the Editor, you'll just see a couple patterns linked together instead of a huge tree of modules.

It is true that the Simple XML has been getting incremental improvements. For instance as sowings says, doing simple custom drilldowns from charts and tables can now basically be done in the simple xml. However there's plenty more in the long tail of dashboard requirements that still sends people across the chasm into the advanced XML and SVU.

Splunk Employee
Splunk Employee

Have you considered XSLT?

Also, version 6 includes a lot more capabilities that used to require advanced XML. You may find that you can trade in your "HiddenSearch, JobProgessIndicator, HiddenChartFormatter, JSChart, Redirector" for a "<chart>" and maybe some nested "<drilldown>".

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>