All Apps and Add-ons

Sideview Utils: How to use $foo$ to select chart type from a pulldown?

jedatt01
Builder

Hi i'm trying to use a Pulldown to be able to populate a search downstream with the type of chart I want to display (eg. line, bar, column). I'm trying to use $chartType$ from the pulldown to populate $chartType$. My code below:

<view autoCancelInterval="90" isSticky="False" isVisible="true" onunloadCancelJobs="true" template="dashboard.html">
  <label>Test Dashboard</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="appHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="HTML" layoutPanel="viewHeader">
    <param name="html">
      <![CDATA[ <h1>Event Type Compairson</h1> ]]>
    </param>
  </module>
  <!--  EXAMPLE BEGIN  -->
  <module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">index=summary search_name="Events Counts by Message" | dedup MESSAGE_TEXT | table MESSAGE_TEXT | Sort +MESSAGE_TEXT</param>
    <module name="ValueSetter"> 
      <param name="name">MESSAGE_TEXT</param>
      <param name="value">Authentication succeeded</param>
    <!-- Pulldown 1 -->
    <module name="Pulldown">
      <param name="name">MESSAGE_TEXT</param>
      <param name="label">Event Type:</param>
      <param name="size">8</param>
      <param name="separator">\"+OR+MESSAGE_TEXT=\"</param>
      <param name="outerTemplate">( MESSAGE_TEXT=\"$MESSAGE_TEXT$\" )</param>
      <param name="searchFieldsToDisplay">
        <list>
          <param name="label">MESSAGE_TEXT</param>
          <param name="value">MESSAGE_TEXT</param>
        </list>
      </param>
      <!-- Text Boxes -->
      <module name="TextField">
        <param name="name">day</param>
        <param name="float">left</param>
        <param name="label">Enter Start Date:</param>
        <param name="default">enter date</param>
      <module name="TextField">
        <param name="name">day2</param>
        <param name="float">left</param>
        <param name="label">Enter End Date:</param>
        <param name="default">enter date</param>
      <module name="Pulldown">
        <param name="name">$chartType$</param>
        <param name="float">left</param>
        <param name="label">Chart Type:</param>
        <param name="staticOptions">
        <list>
          <param name="label">Line Graph</param>
          <param name="value">line</param>
        </list>
        <list>
          <param name="label">Column Chart</param>
          <param name="value">column</param>
        </list>
        <list>
          <param name="label">Bar Chart</param>
          <param name="value">bar</param>
        </list>
        <list>
          <param name="label">Area Graph</param>
          <param name="value">area</param>
        </list>          
        </param>
        <module name="Button">
           <param name="allowSoftSubmit">False</param>
          <!-- main search -->
  <module name="Search" layoutPanel="panel_row1_col1">
        <param name="search">| gentimes start=$day$ end=$day2$
| eventstats max(starttime) as maxstart 
| eval offset=maxstart-starttime | head 1 | append [| gentimes start=$day$ end=$day2$
| eventstats max(starttime) as maxstart 
| eval offset=maxstart-starttime | tail 1]
| map search="
     search starttimeu::$$starttime$$ endtimeu::$$endtime$$ index=summary search_name=\"Events Counts by Message\" $MESSAGE_TEXT$
     |eval key_text = strftime($$starttime$$, \"%Y-%m-%d\") + \" \" + MESSAGE_TEXT
     | timechart span=1h values(count) by key_text 
     | eval _time = _time + $$offset$$
   " 
| stats first(*) as * by _time</param>
       <module name="HiddenChartFormatter">
            <param name="charting.chart">$chartType$</param>
            <param name="charting.chart.nullValueMode">connect</param>
            <module name="JSChart">
               </module>
              </module>
             </module>           
            </module>
           </module> 
          </module>
        </module>
       </module>
      </module>
    </module>
</view>
1 Solution

sideview
SplunkTrust
SplunkTrust

OK. There are two problems here.

1) HiddenChartFormatter is not a Sideview module, and it does not do $foo$ substitution. So with this param

<param name="charting.chartType">$chartType$</param>

unfortunately it is trying to set the chart type to the literal string "$chartType$" including the dollar signs and all.

Solution: Either

a) you can use the Sideview module ValueSetter with the one line param

<param name="arg.charting.chartType">$chartType$</param>

ValueSetter is a Sideview module so it does do $foo$ substitution.

or

b) You can simply change the "name" param of your Pulldown to already be "charting.chart", using:

<param name="name">charting.chart</param>

and then you don't need either ValueSetter or HiddenChartFormatter. Instead the key will come right off the Pulldown already with the right $foo$ name.

2) This brings me to the second problem. Right now you have the Pulldown configured with:

<module name="Pulldown">
  <param name="name">$chartType$</param>

but you can't wrap that in dollar signs or it wont work. Instead you would want this:

<module name="Pulldown">
  <param name="name">chartType</param>

Here are some other improvements you can look into, although these are kind of extra credit things to help simplify and make things more readable.

3) Assuming you're on 2.X or 3.X, you can replace this:

<param name="searchFieldsToDisplay">
  <list>
    <param name="label">MESSAGE_TEXT</param>
    <param name="value">MESSAGE_TEXT</param>
  </list>
</param>

with just

<param name="valueField">MESSAGE_TEXT</param> 

Or, since the name of the Pulldown module is MESSAGE_TEXT, you can replace it with

<param name="valueField">$name$</param> 

which can further reduce copy-paste mistakes

4) I'm confused by what the $$starttime$$ and $$endtime$$ tokens are doing in there but that looks very wrong. Do you have querystring arguments whose names themselves have dollar signs in them? You don't want that if so and it's probably causing some problems.

5) It's extremely awkward to have

<param name="separator">\"+OR+MESSAGE_TEXT=\"</param>
<param name="outerTemplate">( MESSAGE_TEXT=\"$MESSAGE_TEXT$\" )</param>

What you want instead is just

<param name="template">MESSAGE_TEXT="$value$"</param>
<param name="separator">+OR+</param>
<param name="outerValue">( $value$ )</param>

Or, since the "name" param is "MESSAGE_TEXT", you can use the $name$ shorthand again:

<param name="template">$name$="$value$"</param>
<param name="separator">+OR+</param>
<param name="outerValue">( $value$ )</param>

6) You may want to use the CheckboxPulldown module instead of using a Pulldown in multiple-selection mode. The behavior is a little different, in that all of the options are selected by default and there's no "all" option, but quite often that actually matches what people want.

7) You should have a Message module in the view. Most Sideview modules, when they have some critical error to communicate to the user or to the developer, will do so in a big red error message within their own space. However some older modules and error conditions in the framework itself still rely on the old Message module to display errors. So therefore if you don't have a Message module there, you may be hiding very useful error messaging from yourself.

View solution in original post

sideview
SplunkTrust
SplunkTrust

OK. There are two problems here.

1) HiddenChartFormatter is not a Sideview module, and it does not do $foo$ substitution. So with this param

<param name="charting.chartType">$chartType$</param>

unfortunately it is trying to set the chart type to the literal string "$chartType$" including the dollar signs and all.

Solution: Either

a) you can use the Sideview module ValueSetter with the one line param

<param name="arg.charting.chartType">$chartType$</param>

ValueSetter is a Sideview module so it does do $foo$ substitution.

or

b) You can simply change the "name" param of your Pulldown to already be "charting.chart", using:

<param name="name">charting.chart</param>

and then you don't need either ValueSetter or HiddenChartFormatter. Instead the key will come right off the Pulldown already with the right $foo$ name.

2) This brings me to the second problem. Right now you have the Pulldown configured with:

<module name="Pulldown">
  <param name="name">$chartType$</param>

but you can't wrap that in dollar signs or it wont work. Instead you would want this:

<module name="Pulldown">
  <param name="name">chartType</param>

Here are some other improvements you can look into, although these are kind of extra credit things to help simplify and make things more readable.

3) Assuming you're on 2.X or 3.X, you can replace this:

<param name="searchFieldsToDisplay">
  <list>
    <param name="label">MESSAGE_TEXT</param>
    <param name="value">MESSAGE_TEXT</param>
  </list>
</param>

with just

<param name="valueField">MESSAGE_TEXT</param> 

Or, since the name of the Pulldown module is MESSAGE_TEXT, you can replace it with

<param name="valueField">$name$</param> 

which can further reduce copy-paste mistakes

4) I'm confused by what the $$starttime$$ and $$endtime$$ tokens are doing in there but that looks very wrong. Do you have querystring arguments whose names themselves have dollar signs in them? You don't want that if so and it's probably causing some problems.

5) It's extremely awkward to have

<param name="separator">\"+OR+MESSAGE_TEXT=\"</param>
<param name="outerTemplate">( MESSAGE_TEXT=\"$MESSAGE_TEXT$\" )</param>

What you want instead is just

<param name="template">MESSAGE_TEXT="$value$"</param>
<param name="separator">+OR+</param>
<param name="outerValue">( $value$ )</param>

Or, since the "name" param is "MESSAGE_TEXT", you can use the $name$ shorthand again:

<param name="template">$name$="$value$"</param>
<param name="separator">+OR+</param>
<param name="outerValue">( $value$ )</param>

6) You may want to use the CheckboxPulldown module instead of using a Pulldown in multiple-selection mode. The behavior is a little different, in that all of the options are selected by default and there's no "all" option, but quite often that actually matches what people want.

7) You should have a Message module in the view. Most Sideview modules, when they have some critical error to communicate to the user or to the developer, will do so in a big red error message within their own space. However some older modules and error conditions in the framework itself still rely on the old Message module to display errors. So therefore if you don't have a Message module there, you may be hiding very useful error messaging from yourself.

jedatt01
Builder

Thanks this worked!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...