All Apps and Add-ons

Sideview Utils: Is it possible to make CheckboxPulldown render with none of the dynamic options selected instead of all?

kingsizebk
Path Finder

I am running Sideview Utils 3.3.2 in Splunk 6.1.7 on Windows 2008r2.

I have a dashboard where I use several chained and nested CheckboxPulldowns in order to reduce the sheer number of events that will ultimately need to be send to a JSChart. It seems that the CheckboxPulldown will always render the dynamic options selected but I would like it to render with none of them selected. Is that possible? Here is the XML:

<view isSticky="False" isVisible="true" onunloadCancelJobs="true" template="dashboard.html">
  <label>product System Metrics</label>

  <module name="AccountBar" layoutPanel="appHeader" />

  <module name="AppBar" layoutPanel="appHeader" />

  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="HTML" layoutPanel="viewHeader">
    <param name="html"><![CDATA[<b>product System Metrics</b>]]></param>

    <module name="TimeRangePicker" layoutPanel="panel_row1_col1_grp1" autoRun="True">
      <param name="label">Select Date / Time</param>
      <param name="default">Last 60 minutes</param>

      <module name="Search">
        <param name="search"><![CDATA[ | savedsearch product_system_metrics]]></param>

        <module name="PostProcess">
          <param name="search"><![CDATA[ | table environmentName applicationRole shortName | dedup environmentName applicationRole shortName]]></param>

          <module name="CheckboxPulldown" layoutPanel="panel_row1_col1_grp2">
            <param name="postProcess"> | table environmentName | dedup environmentName</param>
            <param name="label">Select Environment(s)</param>
            <param name="postProcess"> | table environmentName | dedup environmentName</param>
            <param name="name">selectedEnvs</param>
            <param name="valueField">environmentName</param>
            <param name="staticOptions"/>
            <param name="template">environmentName="$value$"</param>

            <module name="CheckboxPulldown">
              <param name="label">Select Role(s)</param>
              <param name="postProcess"> | search $selectedEnvs$ | table applicationRole | dedup applicationRole</param>
              <param name="name">selectedRoles</param>
              <param name="valueField">applicationRole</param>
              <param name="staticOptions"/>
              <param name="template">applicationRole="$value$"</param>

              <module name="CheckboxPulldown">
                <param name="label">Select Host(s)</param>
                <param name="postProcess"> | search $selectedEnvs$ $selectedRoles$ | table shortName | dedup shortName</param>
                <param name="staticOptions"/>
                <param name="template">shortName="$value$"</param>
                <param name="valueField">shortName</param>
                <param name="name">selectedHosts</param>

                <module name="Pulldown" layoutPanel="panel_row1_col1_grp3">
                  <param name="label">Select Time Buckets</param>
                  <param name="template">$value$</param>
                  <param name="name">selectedSpan</param>
                  <param name="staticOptions">
                    <list>
                      <param name="selected">true</param>
                      <param name="value"/>
                      <param name="label">None</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=1m</param>
                      <param name="label">One Minute</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=5m</param>
                      <param name="label">Five Minutes</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=10m</param>
                      <param name="label">Ten Minutes</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=15m</param>
                      <param name="label">Fifteen Minutes</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=30m</param>
                      <param name="label">Thirty Minutes</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=1h</param>
                      <param name="label">One Hour</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=2h</param>
                      <param name="label">Two Hours</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=3h</param>
                      <param name="label">Three Hours</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=4h</param>
                      <param name="label">Four Hours</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=6h</param>
                      <param name="label">Six Hours</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=12h</param>
                      <param name="label">Twelve Hours</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=1d</param>
                      <param name="label">One Day</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=7d</param>
                      <param name="label">One week</param>
                    </list>
                    <list>
                      <param name="selected">false</param>
                      <param name="value">span=1mon</param>
                      <param name="label">One Month</param>
                    </list>
                  </param>

                  <module name="Pulldown" layoutPanel="panel_row1_col1_grp3">
                    <param name="label">Select a Function</param>
                    <param name="template">$value$</param>
                    <param name="name">mathematicalFunction</param>
                    <param name="staticOptions">
                      <list>
                        <param name="selected">true</param>
                        <param name="value">avg</param>
                        <param name="label">average</param>
                      </list>
                      <list>
                        <param name="selected">false</param>
                        <param name="value">min</param>
                        <param name="label">minimum</param>
                      </list>
                      <list>
                        <param name="selected">false</param>
                        <param name="value">max</param>
                        <param name="label">maximum</param>
                      </list>
                      <list>
                        <param name="selected">false</param>
                        <param name="value">median</param>
                        <param name="label">median</param>
                      </list>
                      <list>
                        <param name="selected">false</param>
                        <param name="value">mean</param>
                        <param name="label">mean</param>
                      </list>
                      <list>
                        <param name="selected">false</param>
                        <param name="value">stdev</param>
                        <param name="label">deviation</param>
                      </list>
                      <list>
                        <param name="selected">false</param>
                        <param name="value">per_day</param>
                        <param name="label">per day</param>
                      </list>
                      <list>
                        <param name="selected">false</param>
                        <param name="value">per_hour</param>
                        <param name="label">per hour</param>
                      </list>
                      <list>
                        <param name="selected">false</param>
                        <param name="value">per_minute</param>
                        <param name="label">per minute</param>
                      </list>
                      <list>
                        <param name="selected">false</param>
                        <param name="value">values</param>
                        <param name="label">actual</param>
                      </list>
                    </param>

                    <module name="ExtendedSubmitButton" layoutPanel="panel_row1_col1_grp4">
                      <param name="label">Search</param>
                      <param name="updatePermalink">True</param>

                      <module name="SearchControls" layoutPanel="viewHeader">

                        <module name="Tabs" layoutPanel="panel_row2_col1">
                          <param name="name">metricName</param>
                          <param name="staticTabs">
                            <list>
                              <param name="label">CPU Utilization</param>
                              <param name="value">Processor</param>
                            </list>
                            <list>
                              <param name="label">Memory Utilization</param>
                              <param name="value">Memory</param>
                            </list>
                            <list>
                              <param name="label">Load Average</param>
                              <param name="value">Load</param>
                            </list>
                            <list>
                              <param name="label">Work List</param>
                              <param name="value">Work</param>
                            </list>
                            <list>
                              <param name="label">Established Connections</param>
                              <param name="value">Established</param>
                            </list>
                            <list>
                              <param name="label">Internal FS Utilization</param>
                              <param name="value">Internal</param>
                            </list>
                            <list>
                              <param name="label">Temporary FS Utilization</param>
                              <param name="value">Temporary</param>
                            </list>
                            <list>
                              <param name="label">Encrypted FS Utilization</param>
                              <param name="value">Encrypted</param>
                            </list>
                          </param>

                          <module name="ValueSetter">
                            <param name="if.$metricName$=Load[priority=3]">$mathematicalFunction$(Load)</param>
                            <param name="name">fieldName</param>
                            <param name="if.$metricName$=Established[priority=5]">$mathematicalFunction$(Established)</param>
                            <param name="if.$metricName$=Encrypted[priority=8]">$mathematicalFunction$(Encrypted)</param>
                            <param name="if.$metricName$=Memory[priority=2]">$mathematicalFunction$(Memory)</param>
                            <param name="if.$metricName$=Temporary[priority=7]">$mathematicalFunction$(Temporary)</param>
                            <param name="if.$metricName$=Work[priority=4]">$mathematicalFunction$(Work)</param>
                            <param name="if.$metricName$=Processor[priority=1]">$mathematicalFunction$(Processor)</param>
                            <param name="if.$metricName$=Internal[priority=6]">$mathematicalFunction$(Internal)</param>

                            <module name="ValueSetter">
                              <param name="if.$metricName$=Load[priority=3]">Average Load by Host</param>
                              <param name="name">chartTitle</param>
                              <param name="if.$metricName$=Established[priority=5]">Average Established TCP Connections by Host</param>
                              <param name="if.$metricName$=Encrypted[priority=8]">Average Encrypted Filesystem Utilization by Host</param>
                              <param name="if.$metricName$=Memory[priority=2]">Average Memory Utilization by Host</param>
                              <param name="if.$metricName$=Temporary[priority=7]">Average Temporary Filesystem Utilization by Host</param>
                              <param name="if.$metricName$=Work[priority=4]">Average Work List by Host</param>
                              <param name="if.$metricName$=Processor[priority=1]">Average CPU Utilization by Host</param>
                              <param name="if.$metricName$=Internal[priority=6]">Average Internal Filesystem Utilization by Host</param>

                              <module name="ValueSetter">
                                <param name="if.$metricName$=Load[priority=3]">Load=*</param>
                                <param name="name">statusProvider</param>
                                <param name="if.$metricName$=Established[priority=5]">Established=*</param>
                                <param name="if.$metricName$=Encrypted[priority=8]">Encrypted=*</param>
                                <param name="if.$metricName$=Memory[priority=2]">Memory=*</param>
                                <param name="if.$metricName$=Temporary[priority=7]">Temporary=*</param>
                                <param name="if.$metricName$=Work[priority=4]">Work</param>
                                <param name="if.$metricName$=Processor[priority=1]">Processor=*</param>
                                <param name="if.$metricName$=Internal[priority=6]">Internal=*</param>

                                <module name="HTML">
                                  <param name="html"><![CDATA[$search$ | search $selectedEnvs$ $selectedRoles$ $selectedHosts$ $statusProvider$ | timechart $selectedSpan$ $fieldName$ by shortName]]></param>

                                  <module name="Gate">
                                    <param name="to">timeChart</param>
                                  </module>
                                </module>
                              </module>
                            </module>
                          </module>
                        </module>
                      </module>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>

        <module name="JobProgressIndicator" layoutPanel="panel_row2_col1" />
      </module>
    </module>
  </module>

  <module name="Gate" layoutPanel="panel_row2_col1">
    <param name="id">timeChart</param>

    <module name="PostProcess">
      <param name="search"><![CDATA[ search $selectedHosts$ $statusProvider$ | timechart $selectedSpan$ $fieldName$ by shortName]]></param>

      <module name="HTML">
        <param name="html"><![CDATA[<center><h2>$chartTitle$</h2></center>]]></param>

        <module name="HiddenChartFormatter">
          <param name="chart">line</param>
          <param name="chart.nullValueMode">connect</param>
          <param name="primaryAxisTitle.text">Date / Time</param>
          <param name="secondaryAxisTitle.text">Percent / Number</param>
          <param name="chart">line</param>

          <module name="JSChart">
            <param name="height">350px</param>
            <param name="height">350px</param>

            <module name="Gate">
              <param name="to">Drilldown_Table</param>
            </module>
          </module>
        </module>

        <module name="Pager" autoRun="True">

          <module name="SimpleResultsTable">
            <param name="dataOverlayMode">heatmap</param>
          </module>
        </module>
      </module>
    </module>
  </module>

  <module name="Gate" layoutPanel="panel_row3_col1">
    <param name="id">Drilldown_Table</param>

    <module name="ValueSetter">
      <param name="arg.earliest">$search.timeRange.earliest$</param>
      <param name="arg.latest">$search.timeRange.latest$</param>

      <module name="PostProcess">
        <param name="search"><![CDATA[search $selectedHosts$ $click.searchTerms$ _time >= $earliest$ AND _time <= $latest$ | transaction maxspan=1s | stats values(Processor) as Processor values(Memory) as Memory values(Established) as Established values(Load) as Load values(Work) as WorkList values(Internal) as InternalFS values(Temporary) as TemporaryFS values(Encrypted) as EncryptedFS by _time,shortName]]></param>

        <module name="Pager">
          <param name="count">50</param>

          <module name="SimpleResultsTable">
            <param name="drilldown">row</param>
            <param name="dataOverlayMode">heatmap</param>

            <module name="PostProcess">
              <param name="search"><![CDATA[ | eval secondAgoTime=relative_time("$search.timeRange.earliest$", "-15s") | eval secondLaterTime=relative_time("$search.timeRange.latest$", "+15s")]]></param>

              <module name="ResultsValueSetter">
                <param name="fields">secondAgoTime,secondLaterTime</param>

                <module name="Redirector">
                  <param name="arg.latest">$secondLaterTime$</param>
                  <param name="arg.q">index=conplfbtest $click.searchTerms$</param>
                  <param name="arg.earliest">$secondAgoTime$</param>
                  <param name="popup">True</param>
                  <param name="url">search</param>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>
0 Karma

kingsizebk
Path Finder

OK, I was being a little bit ignorant, the answer to my first question (have none of the CheckBoxPulldown options selected by default) already answered here: Is it possible to pre-[de]select options in a CheckboxPulldown (sideview)

Basiclly, I needed to understand that the answer I linked to meant that I needed to put a ValueSetter like this:

<module name="ValueSetter">
            <param name="value">""</param>
            <param name="name">selectedEnvs</param>

Above the a CheckboxPulldown like this:

<module name="CheckboxPulldown" layoutPanel="panel_row1_col1_grp2">
              <param name="postProcess"> | table environmentName | dedup environmentName</param>
              <param name="label">Select Environment(s)</param>
              <param name="postProcess"> | table environmentName | dedup environmentName</param>
              <param name="name">selectedEnvs</param>
              <param name="valueField">environmentName</param>
              <param name="staticOptions"/>
              <param name="template">environmentName="$value$"</param>

I still have not figured out why the "Search generated too much data for the current display configuration, results have been truncated" is being displayed, so please help me out, if you can...

0 Karma

sideview
SplunkTrust
SplunkTrust

One addendum - Whatever "ExtendedSubmitButton is, I would be highly suspicious of it and you almost certainly should use the Sideview "Button" module instead.

And the "results have been truncated" message concerns something pretty different - what that's saying is that the dashboard is set up so that the charting library is being asked to consume more json rows or columns than it is comfortable with. It's truncated those basically with api arguments, and it's just trying to tell you this. The most common culprit, and I suspect the culprit here, is runaway time-granularity options on timechart searches. Like setting a 1minute granularity on a last-7-day search will force it to massively truncate the results.

0 Karma

kingsizebk
Path Finder

I am having another problem with this same dashboard, which may or may not be related... When the line graph, produced by the "timeChart" Gate/PostProcess/JSChart, is drawn with the "TimeRangePicker" (from panel_row1_col1_grp1) set to "Last 24 hours", the "shortName" CheckboxPulldown set to only one of the options (which means that there is only one series) and "selectedSpan" Pulldown is set to "span=6h", the "Search generated too much data for the current display configuration, results have been truncated." message is displayed.

If I take the search, exactly as it is after the ProstProcess in the "timeChart" Gate, and paste it manually into a Search, that message is not displayed.

Getting that message makes no sense to me because a search similar to "timechart span=6h function(field) by something" over a 24 hour period would only produce one series with 5 name/value pairs, which is no where near the limits of the JSChart.

Anyone have any ideas?

0 Karma

kingsizebk
Path Finder

Since there are no solutions from anyone, perhaps someone can tell me if they have any suggestions for how this could be done differently?

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...