All Apps and Add-ons

Sideview Utils: Table hiddenFields param not substituting 'variables'

RaulMurillo
Engager

Hi,
I am using a Sideview Utils (2.2) Table module whose columns are only shown if selected by the user. Each column has an associated checkbox; if selected, the column is shown in the table. For that, the param hiddenFields comes in very handy. Unfortunately, it does not seem to work when I pass the value from the checkbox, as in the snippet below. The 'variable' $ColHost$ is not substituted by its actual value.

      < module name="Checkbox" layoutPanel="panel_row1_col1" >
      < param name="name">ColHost< /param >
      < param name="label">Host< /param >
      < param name="checked">True< /param >
      < param name="offValue">Host< /param >
      < param name="onValue">< /param>
      < module name="Search" layoutPanel="panel_row3_col1" autoRun="True">
         < param name="search">< ![CDATA[
                sourcetype=MRS_MESSAGES | search messageID NOT null |
                table Host Application   ... 
         ]]>< /param>
        < param name="earliest">-5h< /param>
        < param name="latest">now< /param>

        < module name="Pager" layoutPanel="panel_row3_col1">
          < module name="Table">
            < param name="hiddenFields">$ColHost$< /param>
            < param name="rowClass">$row.fields.Severity$< /param>
            ....

I have tried using the column name directly (Host) and that works correctly. But when I use $ColHost$, then the column is always shown, even when $ColHost$ holds the value Host.

sideview
SplunkTrust
SplunkTrust

It's just an oversight I'm afraid although an easy one to fix. I'll be able to put out a fix for this in the next version of Sideview Utils which is coincidentally releasing today or tomorrow latest.

Also, I noticed that the "fields" param doesn't allow $foo$ replacement either so I've fixed that as well.

As a possible workaround, know that if you have a "results.fields" key, that's the key the FieldPicker uses, and the table will listen to that. So although it's a positive list instead of an exclusion list, you could use a ValueSetter module or if you're comfortable with the weirder side of ResultsValueSetter, you could use a PostProcess and a ResultsValueSetter module.

Either way you could basically create a "results.fields" key upstream from the Table. The Table will always set it's field list to that key value if it sees it there.

0 Karma

sideview
SplunkTrust
SplunkTrust

Just to follow up - this was indeed fixed just a few days later. Specifically in 2.2.6 which released Nov 15th 2012. Latest version is 2.2.10 and release notes as always are here: http://sideviewapps.com/apps/sideview-utils/release-notes/

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...