All Apps and Add-ons

Pulldown module: Statically setting two values per pulldown option

Lucas_K
Motivator

What I'm trying to create is a static pulldown that is able to create, and then be referenced independently, more than a one $foo$ variable at a time.

The dynamic pull down example (app/sideview_utils/pulldown7_multivalued) is exactly what I need with the exception that I don't want to populate the combinedValue field without using a search to populate the "combinedValue" field. Is there a way I can use valueSetter to create the set of values that it would be expecting?

My usage example is a custom "time picker" which will feed both an earliest parameter to the end of a base search and a separate bucket span/timechart span option (very late in the search string) to multiple post process modules further down.

I know I can make this work with using 2 pull downs and separate values but the users of this panel won't understand what the span option is. Worse they could choose a value that removed any value from the down stream graphs and tables. ie. 1 month earliest + 1 minute time span + results table=100's of lines = Not very useful when single day span would have been prefered.

Thanks. 😉

1 Solution

sideview
SplunkTrust
SplunkTrust

Several Sideview Utils users have made custom time range pickers out of the Pulldown in exactly this manner, where the values have an earliest component and a latest component, which is very similar. You just use the same technique as that documentation page, but you use the staticOptions param to define your static options, and you don't use the valueField param at all. (See the Pulldown docs page about static Pulldowns).

So if you're making timeranges, "," is a good delimiter. here's a little example of a custom time range picker in action. I actually made each Pulldown option have 3 values - earliest, latest and span, but you get the idea and you can modify it to do only two.

<module name="Pulldown">
  <param name="name">customTime</param>
  <param name="label">Time Range</param>
  <param name="staticOptions">
    <list>
      <param name="value">-24h,+1h@h,1h</param>
      <param name="label">Last 24 hours</param>
    </list>
    <list>
      <param name="value">-60min,now,1min</param>
      <param name="label">Last 60 minutes</param>
    </list>
  </param>
  <module name="ValueSetter">
    <param name="name">customTimeSplit</param>
    <param name="delim">,</param>
    <param name="value">$customTime$</param>
    <module name="Search">
      <param name="search">index=* | timechart count span="$customTimeSplit[2]$"</param>
      <param name="earliest">$customTimeSplit[0]$</param>
      <param name="latest">$customTimeSplit[1]$</param>
      <module name="Pager">
        <module name="Table"/>
      </module>
    </module>
  </module>
</module>

View solution in original post

Lucas_K
Motivator

That's correct.

The situation is that we only have 3-4 options and want to lock down what is available into the least number of dropdowns possible.

0 Karma

sideview
SplunkTrust
SplunkTrust

Several Sideview Utils users have made custom time range pickers out of the Pulldown in exactly this manner, where the values have an earliest component and a latest component, which is very similar. You just use the same technique as that documentation page, but you use the staticOptions param to define your static options, and you don't use the valueField param at all. (See the Pulldown docs page about static Pulldowns).

So if you're making timeranges, "," is a good delimiter. here's a little example of a custom time range picker in action. I actually made each Pulldown option have 3 values - earliest, latest and span, but you get the idea and you can modify it to do only two.

<module name="Pulldown">
  <param name="name">customTime</param>
  <param name="label">Time Range</param>
  <param name="staticOptions">
    <list>
      <param name="value">-24h,+1h@h,1h</param>
      <param name="label">Last 24 hours</param>
    </list>
    <list>
      <param name="value">-60min,now,1min</param>
      <param name="label">Last 60 minutes</param>
    </list>
  </param>
  <module name="ValueSetter">
    <param name="name">customTimeSplit</param>
    <param name="delim">,</param>
    <param name="value">$customTime$</param>
    <module name="Search">
      <param name="search">index=* | timechart count span="$customTimeSplit[2]$"</param>
      <param name="earliest">$customTimeSplit[0]$</param>
      <param name="latest">$customTimeSplit[1]$</param>
      <module name="Pager">
        <module name="Table"/>
      </module>
    </module>
  </module>
</module>

Lucas_K
Motivator

ahhh it was the "-24h,+1h@h,1h" was what I was looking for followed by the valuesetter module.

I didn't know how to "set" and then retrieve the values. I'd tried doing it several ways but it just wouldn't take.

Will have to try it tomorrow.

Thanks for that!

0 Karma

sideview
SplunkTrust
SplunkTrust

When you say that example "is exactly what I need with the exception that I don't want to populate the combinedValue field without using a search to populate the "combinedValue" field.", do you mean that you want to do the same thing, but with "static" options and not using a search to render dynamic options?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...