All Apps and Add-ons

Are "Module Groupings" in the future for Splunk and/or Sideview Utils?

jraynor196
Explorer

What I mean by that is usually I end up stitching
together the same modules over and over. For example, Search, Job
Progress, Hidden Chart Formatter, JS Chart, Redirector.

It would begreat is somehow we could combine those modules in 1 "Grouping" so I
can add them all at once. I end up doing the same thing over and over again which after a whie becomes tedious and somewhat less productive.

0 Karma

sideview
SplunkTrust
SplunkTrust

Yep. In the land of Sideview Utils this is called "Patterns", and there has been some tinkering to implement this as a module called "Pattern". You would specify a pattern name and a couple arguments to that pattern, the pattern definition would be in your app somewhere, and ultimately the whole giant block of reusable form-element config or what-have-you would be reduced to a few lines.

There are a lot of technical hurdles in the way of doing it as a module, and it may end up coming into the world slightly differently - with Sideview Utils packaging it's own entirely standalone view controller, such that the URL in your browser as you moved from view to view would actually be
/en-US/custom/sideview_utils/views/your_dashboard_name_here

Yes if there were reusable patterns this would remove a huge amount of pain and frustration from splunk view development. That said, the off-the-shelf patterns that you would get out of the box would not be the big deal - rather it's the fact that all splunk deployments have some little block of shared Pulldown + TextField + TimeRangePicker + Button that they have to use over and over again.... Or some nutty looking SingleValue pattern with gauge stuff in it. Every deployment has its own little patterns it would want to define.

Anyway, the ability to have some extensible macro layer to just roll up complex view config into a "pattern" will be great.

And then from there, I could easily make the Sideview Editor operate at the Pattern layer as well as the raw-Module layer. So you can "add new pattern" and in the schematic view of the Editor, you'll just see a couple patterns linked together instead of a huge tree of modules.

It is true that the Simple XML has been getting incremental improvements. For instance as sowings says, doing simple custom drilldowns from charts and tables can now basically be done in the simple xml. However there's plenty more in the long tail of dashboard requirements that still sends people across the chasm into the advanced XML and SVU.

sowings
Splunk Employee
Splunk Employee

Have you considered XSLT?

Also, version 6 includes a lot more capabilities that used to require advanced XML. You may find that you can trade in your "HiddenSearch, JobProgessIndicator, HiddenChartFormatter, JSChart, Redirector" for a "<chart>" and maybe some nested "<drilldown>".

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...