All Apps and Add-ons

FlashChart not drawing on first search with Sideview variable

nazdrynau
Explorer

I have Sideview TextField variable that I pass to search (with timechart in it). This search send data downstream to 2 modules, one of them FlashChart another SimpleResultsTable.

When I execute search SimpleResultsTable starting to show results as they come, but FlashChart does not draw at all.
Now If I re-run search FlashChart shows full graph and working Ok from now on.
So FlashChart does not work when View just loaded and on first search submission and works fine on consequential submissions.

This is my view:



<view  onunloadCancelJobs="false" template="search.html">
  <label>User Latency Graph</label>
  <!-- standard splunk chrome at the top -->
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader" />
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TextField" layoutPanel="splSearchControls-inline" autoRun="False">
    <param name="name">username</param>
    <param name="float">left</param>
    <param name="label">User Name:</param>
    <param name="default"></param>
      <module name="Search">
        <param name="search">index=wmiperf source="WMI:Citrix-Latency" LatencySessionAverage>0 CitrixUser=$username$  |timechart max(LatencyLastRecorded) as HourlyLastRecordedMaxLatency, max(LatencySessionAverage) as HourlyAverageMaxLatency span=1h|search HourlyAverageMaxLatency>0 |sort -_time  </param>
        <module name="TimeRangePicker">
           <param name="searchWhenChanged">True</param>
           <param name="selected">Last 4 hours</param>
           <module name="SubmitButton">
              <param name="allowSoftSubmit">True</param>
              <module name="Message" layoutPanel="graphArea">
                  <param name="filter">splunk.search.job</param>
                  <param name="clearOnJobDispatch">True</param>
                  <param name="maxSize">2</param>
                  <module name="HiddenChartFormatter">
                        <param name="charting.chart.nullValueMode">zero</param>
                        <param name="chart">column</param>
                        <param name="primaryAxisTitle.text">Latency</param>
                        <param name="secondaryAxisTitle.text">ms</param>
                        <module name="HTML" layoutPanel="graphArea">
                            <param name="html"><![CDATA[
                                <h2>Latency result for user: $username$</h2>
                                ]]></param>
                         </module>
                         <module name="JobProgressIndicator"/>
                         <module name="FlashChart">
                         </module>
                      <!-- end HiddenChartFormatter  -->
                  </module>
                  <module name="Paginator">
                      <param name="entityName">results</param>
                      <param name="maxPages">50</param>
                      <param name="count">10</param>
                      <module name="SimpleResultsTable">
                         <param name="drilldown">all</param>
                         <param name="entityName">results</param>
                      </module>
                  </module>
              </module>
        </module>
      </module>
    </module>
  </module>
</view>
0 Karma

sideview
SplunkTrust
SplunkTrust

Hi nazdrynau,

I cannot really reproduce the problem you describe I'm afraid.

To troubleshoot your root cause a little further
-- what browser and version are you using?

-- if you open the Javascript Console are there any errors that happen in the cases when the FlashChart does nothing? Are there any Javascript errors on startup?
-- If you change from FlashChart to JSChart does the problem go away?

But in the meantime I do have some notes and an edited copy of your view.

1) autoRun="False" will do nothing at all. It's strange but autoRun="True" turns on autorun and any other value of AutoRun is the same as the complete absence of the attribute so you might as well omit it.

2) in your TextField module you were not using the 'template' param, so you had CitrixUser="$username$" in the search. Then if the search is ever submitted with empty input for the CitrixUser, you'd get a syntax error. This can be fixed by simply using the template param and there's a docs page in Utils about that param and why it's a good thing.
3) Since you don't have autoRun turned on, "when the page loads", nothing will happen at all. If you do want the search to run right away, you can put autoRun="True" upstream. I've also put a URLLoader module into your view (below) so that you can actually put ?autoRun="True" into the page URL when you need it, and omit it in cases when you don't. (either with <param name="arg.autoRun">True</param> in a Redirector module, or simply with an html link in an HTML module). Note that URLLoader there will also give you the ability to link to this view and prepopulate the CitrixUser field with values from search results...
4) I reorganized your XML a bit -- the Message module was stitched into the hierarchy which is harmless but weird. I also reordered the invisible modules, to more match emerging conventions across Splunk apps. None of this should change functionality but it's possible I have made a typo along the way. My apologies if so.
5) you had the drilldown param turned on in the SimpleResultsTable, but it had no child modules. This has the odd effect of making the table look clickable when it is not so I turned that off.
6) In addition to adding the template param to your TextField, I followed the convention of having the UI Module's "name" param match the extracted field name. This allows for a less redundant config because you can use $name$="$value$" as the value of the template. (explained in the docs a bit)
7) I replaced Paginator with Pager mostly because you don't have to specify those defaults explicitly and the Pager will work correctly when there's a postprocess search. And I replaced SubmitButton with Button which gives you the option of the 'allowAutoSubmit' param. There are more about these modules in the Sideview docs.

Again, I apologize for not being able to reproduce your problem. Maybe however some of my comments above are helpful.

<view  onunloadCancelJobs="false" template="search.html">
  <label>User Latency Graph</label>
  <!-- standard splunk chrome at the top -->
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader" />
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="Message" layoutPanel="graphArea">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">2</param>
  </module>

  <module name="URLLoader" layoutPanel="mainSearchControls">

    <module name="TextField" layoutPanel="splSearchControls-inline">
      <param name="name">CitrixUser</param>
      <param name="float">left</param>
      <param name="label">User Name:</param>
      <param name="template">$name$="$value$"</param>

      <module name="TimeRangePicker">
        <param name="searchWhenChanged">True</param>
        <param name="selected">Last 4 hours</param>

        <module name="Button">
          <param name="allowSoftSubmit">True</param>

          <module name="Search" layoutPanel="graphArea">
            <param name="search">index=wmiperf source="WMI:Citrix-Latency" LatencySessionAverage>0 $CitrixUser$ |timechart max(LatencyLastRecorded) as HourlyLastRecordedMaxLatency, max(LatencySessionAverage) as HourlyAverageMaxLatency span=1h|search HourlyAverageMaxLatency>0 |sort -_time  </param>

            <module name="HTML">
              <param name="html"><![CDATA[
                <h2>Latency result for user: $CitrixUser.rawValue$</h2>
              ]]></param>
            </module>

            <module name="JobProgressIndicator"/>

            <module name="HiddenChartFormatter">
              <param name="charting.chart.nullValueMode">zero</param>
              <param name="chart">column</param>
              <param name="primaryAxisTitle.text">Latency</param>
              <param name="secondaryAxisTitle.text">ms</param>

              <module name="FlashChart"></module>
            </module>

            <module name="Pager">

              <module name="SimpleResultsTable">
                <param name="entityName">results</param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...