All Apps and Add-ons

Sideview Utils TimeRangePicker - How to bind to specific Table

IngloriousSplun
Communicator

I'm using the TimeRangePicker within Sideview to enable analysts to choose a custom time period for events. My dashboard has multiple tables each displaying results from a different search and I'd like to provide the ability to choose a different time for each Table. The way I have it set up currently is:

<module name="TimeRangePicker" layoutPanel="panel_row1_col1" autorun="True">
  <param name="searchWhenChanged">True</param>
  <param name="default">Last 24 hours </param>
  <module name="Search">
    <param name="search">`mySearchMacro`</param>
    <module name="Pager">
      <module name="Table>
...

Each section of the dashboard is laid out the same, minus a different search. What I've noticed is that when the tables load, they don't seem to load the default time, and when I change the time in one Table, every table updates with the same time range. Is there a way to bind the time picker to that Table?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I would look carefully at how the modules are nested. If a given Table is updating when a TimeRangePicker is changed, in the Sideview XML that means that the Table is downstream from the TimeRangePicker, ie nested within it. It's pretty common for the indentation over the months and years to be slightly off, by virtue of someone adding or removing one or two module tags and not indenting the file to match.

This is understandable, as being forced to correctly indent large and heavily nested xml files is arguably a form of torture. Fortunately you can instantly fix and clean up all the indentation in any Sideview XML view by Loading that view in the Sideview Editor, picking a random module to edit, and submitting the edit without changing anything. Granted, if you're an app developer and you keep the views in default, it'll write them to local, but it's still exceptionally useful.

View solution in original post

sideview
SplunkTrust
SplunkTrust

I would look carefully at how the modules are nested. If a given Table is updating when a TimeRangePicker is changed, in the Sideview XML that means that the Table is downstream from the TimeRangePicker, ie nested within it. It's pretty common for the indentation over the months and years to be slightly off, by virtue of someone adding or removing one or two module tags and not indenting the file to match.

This is understandable, as being forced to correctly indent large and heavily nested xml files is arguably a form of torture. Fortunately you can instantly fix and clean up all the indentation in any Sideview XML view by Loading that view in the Sideview Editor, picking a random module to edit, and submitting the edit without changing anything. Granted, if you're an app developer and you keep the views in default, it'll write them to local, but it's still exceptionally useful.

IngloriousSplun
Communicator

Yeah, that was a lame oversight on my part. I dumped it into Notepad++ and it needed some hardcore reformatting. Thanks.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...