I am currently working on Splunk to identify behavioral deviations for IT operations, and having trouble integrating the Outlier Viz (from the Machine Learning Toolkit app V3.30) into a dashboard. This dashboard hosts token inputs, which are feeding a SPL search. The results of this search are then displayed using the Outlier visualization. Here is an extract from this dashboard:
<viz depends="$timeframe_analysis$" type="Splunk_ML_Toolkit.OutliersViz"> <title>My Dashboard title</title> <search> <query>| inputlookup mylittlelookup | search data_type="$analysis_method$" AND data_source=$selected_source$ | ... some_search_wich_correctly_populates_outliers ... <query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="Splunk_ML_Toolkit.OutliersViz.showOutlierCount">true</option> </viz>
All token used in the search query are sets using inputs at the beginning of the dashboard, such as this one:
<input type="dropdown" token="selected_source"> <label>Source Sélectionnée</label> <initialValue>1</initialValue> <fieldForLabel>data_source_human</fieldForLabel> <fieldForValue>data_source</fieldForValue> <search> <query> | inputlookup mylittlelookup | ... some search that format the lookup ... | stats values(data_source_human) as data_source_human by data_source </query> <done> <condition match="'job.resultCount'<2"> <set token="form.selected_source">1</set> </condition> </done> </search> </input>
The issue occurs whenever the value of one of these token inputs is changed by the user. This triggers a refresh of the Outlier visualization, and the height of the panel increase of a (not so) small percentage. If the process is repeated, the viz panel becomes quickly unreadable.
Here are the attempts I made to solve this issue:
1) Try to override the panel's height by adding a
<option name="charting.height">500px</option> xml child element into the viz element. However, this option does not seem to be taken into account for a "viz" element of this type.
2) Try to find other options from the viz element itself, which would allow to change the panel height. I found the following file :
$SPLUNK_HOME$\apps\Splunk_ML_Toolkit\appserver\static\visualizations\OutliersViz\formatter.html, which seems to be listing allowed parameters for this viz element. Unfortunately, there is no option for height in it. I also found the file
Does somebody knows another way to fix this issue? How can I investigate further at this point??
Thanks a lot for your time and your answers,
This looks like an issue with that visualization. I've filed an internal bug and will update when it's resolved, but in the meantime, #3 is your best option.
Thank you for your assessment. I will dig into that solution #3 then.
When do you think we can expect an answer to the case you created?
The latest version of the Machine Learning Toolkit (3.4.0) should resolve this issue.