All Apps and Add-ons

Display issue while using the Show Outlier viz (from ML toolkit)

pabdola
Explorer

Hi Everyone,

I am currently working on Splunk to identify behavioral deviations for IT operations, and having trouble integrating the Outlier Viz (from the Machine Learning Toolkit app V3.30) into a dashboard. This dashboard hosts token inputs, which are feeding a SPL search. The results of this search are then displayed using the Outlier visualization. Here is an extract from this dashboard:

<viz depends="$timeframe_analysis$" type="Splunk_ML_Toolkit.OutliersViz">
        <title>My Dashboard title</title>
        <search>
          <query>| inputlookup mylittlelookup 
                 | search data_type="$analysis_method$" AND data_source=$selected_source$ 
                 | ... some_search_wich_correctly_populates_outliers ... <query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="Splunk_ML_Toolkit.OutliersViz.showOutlierCount">true</option>
</viz>

All token used in the search query are sets using inputs at the beginning of the dashboard, such as this one:

  <input type="dropdown" token="selected_source">
    <label>Source Sélectionnée</label>
    <initialValue>1</initialValue>
    <fieldForLabel>data_source_human</fieldForLabel>
    <fieldForValue>data_source</fieldForValue>
    <search>
      <query>
        | inputlookup mylittlelookup  | ... some search that format the lookup ...
        | stats values(data_source_human) as data_source_human by data_source
      </query>
      <done>
        <condition match="'job.resultCount'<2">
          <set token="form.selected_source">1</set>
        </condition>
      </done>
    </search>
  </input>

The issue occurs whenever the value of one of these token inputs is changed by the user. This triggers a refresh of the Outlier visualization, and the height of the panel increase of a (not so) small percentage. If the process is repeated, the viz panel becomes quickly unreadable.

Here are the attempts I made to solve this issue:

1) Try to override the panel's height by adding a <option name="charting.height">500px</option> xml child element into the viz element. However, this option does not seem to be taken into account for a "viz" element of this type.

2) Try to find other options from the viz element itself, which would allow to change the panel height. I found the following file : $SPLUNK_HOME$\apps\Splunk_ML_Toolkit\appserver\static\visualizations\OutliersViz\formatter.html, which seems to be listing allowed parameters for this viz element. Unfortunately, there is no option for height in it. I also found the file visualization.js in the same folder, which seems to hosts the javascript code for this view.

3) I am now stuck with only one remaining solution which I would prefer to avoid : coding a little javascript function to force resizing of a viz element to a fixed height each time a parameter is changed

Does somebody knows another way to fix this issue? How can I investigate further at this point??

Thanks a lot for your time and your answers,

0 Karma
1 Solution

sslepian_splunk
Splunk Employee
Splunk Employee

This looks like an issue with that visualization. I've filed an internal bug and will update when it's resolved, but in the meantime, #3 is your best option.

View solution in original post

sslepian_splunk
Splunk Employee
Splunk Employee

This looks like an issue with that visualization. I've filed an internal bug and will update when it's resolved, but in the meantime, #3 is your best option.

pabdola
Explorer

Thank you for your assessment. I will dig into that solution #3 then.
When do you think we can expect an answer to the case you created?

0 Karma

sslepian_splunk
Splunk Employee
Splunk Employee

The latest version of the Machine Learning Toolkit (3.4.0) should resolve this issue.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...