All Apps and Add-ons

Sideview Utils TimeRangePicker - How to bind to specific Table

IngloriousSplun
Communicator

I'm using the TimeRangePicker within Sideview to enable analysts to choose a custom time period for events. My dashboard has multiple tables each displaying results from a different search and I'd like to provide the ability to choose a different time for each Table. The way I have it set up currently is:

<module name="TimeRangePicker" layoutPanel="panel_row1_col1" autorun="True">
  <param name="searchWhenChanged">True</param>
  <param name="default">Last 24 hours </param>
  <module name="Search">
    <param name="search">`mySearchMacro`</param>
    <module name="Pager">
      <module name="Table>
...

Each section of the dashboard is laid out the same, minus a different search. What I've noticed is that when the tables load, they don't seem to load the default time, and when I change the time in one Table, every table updates with the same time range. Is there a way to bind the time picker to that Table?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I would look carefully at how the modules are nested. If a given Table is updating when a TimeRangePicker is changed, in the Sideview XML that means that the Table is downstream from the TimeRangePicker, ie nested within it. It's pretty common for the indentation over the months and years to be slightly off, by virtue of someone adding or removing one or two module tags and not indenting the file to match.

This is understandable, as being forced to correctly indent large and heavily nested xml files is arguably a form of torture. Fortunately you can instantly fix and clean up all the indentation in any Sideview XML view by Loading that view in the Sideview Editor, picking a random module to edit, and submitting the edit without changing anything. Granted, if you're an app developer and you keep the views in default, it'll write them to local, but it's still exceptionally useful.

View solution in original post

sideview
SplunkTrust
SplunkTrust

I would look carefully at how the modules are nested. If a given Table is updating when a TimeRangePicker is changed, in the Sideview XML that means that the Table is downstream from the TimeRangePicker, ie nested within it. It's pretty common for the indentation over the months and years to be slightly off, by virtue of someone adding or removing one or two module tags and not indenting the file to match.

This is understandable, as being forced to correctly indent large and heavily nested xml files is arguably a form of torture. Fortunately you can instantly fix and clean up all the indentation in any Sideview XML view by Loading that view in the Sideview Editor, picking a random module to edit, and submitting the edit without changing anything. Granted, if you're an app developer and you keep the views in default, it'll write them to local, but it's still exceptionally useful.

IngloriousSplun
Communicator

Yeah, that was a lame oversight on my part. I dumped it into Notepad++ and it needed some hardcore reformatting. Thanks.

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...