Hi Everyone,
I am currently working on Splunk to identify behavioral deviations for IT operations, and having trouble integrating the Outlier Viz (from the Machine Learning Toolkit app V3.30) into a dashboard. This dashboard hosts token inputs, which are feeding a SPL search. The results of this search are then displayed using the Outlier visualization. Here is an extract from this dashboard:
<viz depends="$timeframe_analysis$" type="Splunk_ML_Toolkit.OutliersViz">
<title>My Dashboard title</title>
<search>
<query>| inputlookup mylittlelookup
| search data_type="$analysis_method$" AND data_source=$selected_source$
| ... some_search_wich_correctly_populates_outliers ... <query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="Splunk_ML_Toolkit.OutliersViz.showOutlierCount">true</option>
</viz>
All token used in the search query are sets using inputs at the beginning of the dashboard, such as this one:
<input type="dropdown" token="selected_source">
<label>Source Sélectionnée</label>
<initialValue>1</initialValue>
<fieldForLabel>data_source_human</fieldForLabel>
<fieldForValue>data_source</fieldForValue>
<search>
<query>
| inputlookup mylittlelookup | ... some search that format the lookup ...
| stats values(data_source_human) as data_source_human by data_source
</query>
<done>
<condition match="'job.resultCount'<2">
<set token="form.selected_source">1</set>
</condition>
</done>
</search>
</input>
The issue occurs whenever the value of one of these token inputs is changed by the user. This triggers a refresh of the Outlier visualization, and the height of the panel increase of a (not so) small percentage. If the process is repeated, the viz panel becomes quickly unreadable.
Here are the attempts I made to solve this issue:
1) Try to override the panel's height by adding a <option name="charting.height">500px</option>
xml child element into the viz element. However, this option does not seem to be taken into account for a "viz" element of this type.
2) Try to find other options from the viz element itself, which would allow to change the panel height. I found the following file : $SPLUNK_HOME$\apps\Splunk_ML_Toolkit\appserver\static\visualizations\OutliersViz\formatter.html
, which seems to be listing allowed parameters for this viz element. Unfortunately, there is no option for height in it. I also found the file visualization.js
in the same folder, which seems to hosts the javascript code for this view.
3) I am now stuck with only one remaining solution which I would prefer to avoid : coding a little javascript function to force resizing of a viz element to a fixed height each time a parameter is changed
Does somebody knows another way to fix this issue? How can I investigate further at this point??
Thanks a lot for your time and your answers,
This looks like an issue with that visualization. I've filed an internal bug and will update when it's resolved, but in the meantime, #3 is your best option.
This looks like an issue with that visualization. I've filed an internal bug and will update when it's resolved, but in the meantime, #3 is your best option.
Thank you for your assessment. I will dig into that solution #3 then.
When do you think we can expect an answer to the case you created?
The latest version of the Machine Learning Toolkit (3.4.0) should resolve this issue.