All Apps and Add-ons

Are "Module Groupings" in the future for Splunk and/or Sideview Utils?

jraynor196
Explorer

What I mean by that is usually I end up stitching
together the same modules over and over. For example, Search, Job
Progress, Hidden Chart Formatter, JS Chart, Redirector.

It would begreat is somehow we could combine those modules in 1 "Grouping" so I
can add them all at once. I end up doing the same thing over and over again which after a whie becomes tedious and somewhat less productive.

0 Karma

sideview
SplunkTrust
SplunkTrust

Yep. In the land of Sideview Utils this is called "Patterns", and there has been some tinkering to implement this as a module called "Pattern". You would specify a pattern name and a couple arguments to that pattern, the pattern definition would be in your app somewhere, and ultimately the whole giant block of reusable form-element config or what-have-you would be reduced to a few lines.

There are a lot of technical hurdles in the way of doing it as a module, and it may end up coming into the world slightly differently - with Sideview Utils packaging it's own entirely standalone view controller, such that the URL in your browser as you moved from view to view would actually be
/en-US/custom/sideview_utils/views/your_dashboard_name_here

Yes if there were reusable patterns this would remove a huge amount of pain and frustration from splunk view development. That said, the off-the-shelf patterns that you would get out of the box would not be the big deal - rather it's the fact that all splunk deployments have some little block of shared Pulldown + TextField + TimeRangePicker + Button that they have to use over and over again.... Or some nutty looking SingleValue pattern with gauge stuff in it. Every deployment has its own little patterns it would want to define.

Anyway, the ability to have some extensible macro layer to just roll up complex view config into a "pattern" will be great.

And then from there, I could easily make the Sideview Editor operate at the Pattern layer as well as the raw-Module layer. So you can "add new pattern" and in the schematic view of the Editor, you'll just see a couple patterns linked together instead of a huge tree of modules.

It is true that the Simple XML has been getting incremental improvements. For instance as sowings says, doing simple custom drilldowns from charts and tables can now basically be done in the simple xml. However there's plenty more in the long tail of dashboard requirements that still sends people across the chasm into the advanced XML and SVU.

sowings
Splunk Employee
Splunk Employee

Have you considered XSLT?

Also, version 6 includes a lot more capabilities that used to require advanced XML. You may find that you can trade in your "HiddenSearch, JobProgessIndicator, HiddenChartFormatter, JSChart, Redirector" for a "<chart>" and maybe some nested "<drilldown>".

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...