All Apps and Add-ons

Sideview Utils TimeRangePicker - How to bind to specific Table

IngloriousSplun
Communicator

I'm using the TimeRangePicker within Sideview to enable analysts to choose a custom time period for events. My dashboard has multiple tables each displaying results from a different search and I'd like to provide the ability to choose a different time for each Table. The way I have it set up currently is:

<module name="TimeRangePicker" layoutPanel="panel_row1_col1" autorun="True">
  <param name="searchWhenChanged">True</param>
  <param name="default">Last 24 hours </param>
  <module name="Search">
    <param name="search">`mySearchMacro`</param>
    <module name="Pager">
      <module name="Table>
...

Each section of the dashboard is laid out the same, minus a different search. What I've noticed is that when the tables load, they don't seem to load the default time, and when I change the time in one Table, every table updates with the same time range. Is there a way to bind the time picker to that Table?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I would look carefully at how the modules are nested. If a given Table is updating when a TimeRangePicker is changed, in the Sideview XML that means that the Table is downstream from the TimeRangePicker, ie nested within it. It's pretty common for the indentation over the months and years to be slightly off, by virtue of someone adding or removing one or two module tags and not indenting the file to match.

This is understandable, as being forced to correctly indent large and heavily nested xml files is arguably a form of torture. Fortunately you can instantly fix and clean up all the indentation in any Sideview XML view by Loading that view in the Sideview Editor, picking a random module to edit, and submitting the edit without changing anything. Granted, if you're an app developer and you keep the views in default, it'll write them to local, but it's still exceptionally useful.

View solution in original post

sideview
SplunkTrust
SplunkTrust

I would look carefully at how the modules are nested. If a given Table is updating when a TimeRangePicker is changed, in the Sideview XML that means that the Table is downstream from the TimeRangePicker, ie nested within it. It's pretty common for the indentation over the months and years to be slightly off, by virtue of someone adding or removing one or two module tags and not indenting the file to match.

This is understandable, as being forced to correctly indent large and heavily nested xml files is arguably a form of torture. Fortunately you can instantly fix and clean up all the indentation in any Sideview XML view by Loading that view in the Sideview Editor, picking a random module to edit, and submitting the edit without changing anything. Granted, if you're an app developer and you keep the views in default, it'll write them to local, but it's still exceptionally useful.

IngloriousSplun
Communicator

Yeah, that was a lame oversight on my part. I dumped it into Notepad++ and it needed some hardcore reformatting. Thanks.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...