Display issue while using the Show Outlier viz (from ML toolkit)

[pabdola]

Hi Everyone,

I am currently working on Splunk to identify behavioral deviations for IT operations, and having trouble integrating the Outlier Viz (from the Machine Learning Toolkit app V3.30) into a dashboard. This dashboard hosts token inputs, which are feeding a SPL search. The results of this search are then displayed using the Outlier visualization. Here is an extract from this dashboard:

<viz depends="$timeframe_analysis$" type="Splunk_ML_Toolkit.OutliersViz">
        <title>My Dashboard title</title>
        <search>
          <query>| inputlookup mylittlelookup 
                 | search data_type="$analysis_method$" AND data_source=$selected_source$ 
                 | ... some_search_wich_correctly_populates_outliers ... <query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="Splunk_ML_Toolkit.OutliersViz.showOutlierCount">true</option>
</viz>

All token used in the search query are sets using inputs at the beginning of the dashboard, such as this one:

  <input type="dropdown" token="selected_source">
    <label>Source Sélectionnée</label>
    <initialValue>1</initialValue>
    <fieldForLabel>data_source_human</fieldForLabel>
    <fieldForValue>data_source</fieldForValue>
    <search>
      <query>
        | inputlookup mylittlelookup  | ... some search that format the lookup ...
        | stats values(data_source_human) as data_source_human by data_source
      </query>
      <done>
        <condition match="'job.resultCount'<2">
          <set token="form.selected_source">1</set>
        </condition>
      </done>
    </search>
  </input>

The issue occurs whenever the value of one of these token inputs is changed by the user. This triggers a refresh of the Outlier visualization, and the height of the panel increase of a (not so) small percentage. If the process is repeated, the viz panel becomes quickly unreadable.

Here are the attempts I made to solve this issue:

1) Try to override the panel's height by adding a <option name="charting.height">500px</option> xml child element into the viz element. However, this option does not seem to be taken into account for a "viz" element of this type.

2) Try to find other options from the viz element itself, which would allow to change the panel height. I found the following file : $SPLUNK_HOME$\apps\Splunk_ML_Toolkit\appserver\static\visualizations\OutliersViz\formatter.html, which seems to be listing allowed parameters for this viz element. Unfortunately, there is no option for height in it. I also found the file visualization.js in the same folder, which seems to hosts the javascript code for this view.

3) I am now stuck with only one remaining solution which I would prefer to avoid : coding a little javascript function to force resizing of a viz element to a fixed height each time a parameter is changed

Does somebody knows another way to fix this issue? How can I investigate further at this point??

Thanks a lot for your time and your answers,

[sslepian_splunk · Accepted solution]

This looks like an issue with that visualization. I've filed an internal bug and will update when it's resolved, but in the meantime, #3 is your best option.

[pabdola]

Thank you for your assessment. I will dig into that solution #3 then.
When do you think we can expect an answer to the case you created?

[sslepian_splunk]

The latest version of the Machine Learning Toolkit (3.4.0) should resolve this issue.