All Apps and Add-ons

Sideview Utils: Why is my span pulldown not maintaining its value after refreshing the dashboard with my ValueSetter configuration?

IngloriousSplun
Communicator

I've implemented tables with multiple pulldowns - TimeRangePicker and a custom Pulldown for setting span between events. I'm trying to use ValueSetter to maintain the value of these Pulldowns so when the dashboard refreshes the values remain set for the analysts. The ValueSetter config I have for the span Pulldown does not seem to be maintaining its value. Can someone see the mistake? I've also tried changing the token name just in case using the same token name for the Pulldown and ValueSetter was interferring, but no dice.

The below is hand-jammed and copied from word, so some of the formatting doesn't line up.

Thanks!

<view autoCancelInterval="90" isSticky="False" onunloadCancelJobs="true" template="dashboard.html">
  <label>Testing Sideview</label>

  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name=”TimeRangePicker” layoutPanel=”panel1_row1_col1” autoRun=”True”>
    <param name=”searchWhenChanged”>True</param>
    <param name=”default”>Last 24 hours</param>

    <module name=”Pulldown” layoutPanel=”panel1_row1_col1”>
      <param name=”name”>span</param>
      <param name=”label”>Event Span</param>
      <param name=”staticOptions”>
        <list>
          <param name=”label”>All</param>
      <param name=”value”>*</param>
    </list>
    <list>
      <param name=”label”>1 hour</param>
      <param name=”value”>1h</param>
    </list>
      </param>
      <module name=”ValueSetter”>
        <param name=”name”>span</param>
    <param name=”value”>$span</param>

    <module name="TextField" layoutPanel="panel_row1_col1" autoRun="True">
      <param name="name">wild</param>
      <param name="float">left</param>
      <param name="label">Search</param>
      <param name="default">*</param>

      <module name="Search">
        <param name=”search”>`Test_Macro(wild=”$wild$”,span=$span$)` | eval Acknowledge="" | lookup myLookup myIdField OUTPUT state</param>

        <param name="earliest">-1d</param>
        <param name="latest">now</param>
        <module name="Pager">
          <module name="Table">

            <module name="ValueSetter" group="row.fields.Acknowledge">
          <param name="name">state</param>
          <param name="value">$row.fields.state$</param>

          <module name="Checkbox">
            <param name="name">state</param>
            <param name="onValue">ack</param>
            <param name="offValue"></param>

            <module name="Search">
              <param name="search">| inputlookup myLookup | append [stats count | fields - count | eval myIdField="$row.fields.myIdField$" | eval state="$state$"] | stats last(state) as state by myIdField | outputlookup myLookup</param>
              <module name="CustomBehavior">
                <param name="requiresDispatch">True</param>
                      </module>
                   </module>
                 </module>
               </module>
             </module>
           </module>
         </module>
       </module>
     </module>      
  </module>
</view>
0 Karma

sideview
SplunkTrust
SplunkTrust

OK. Thanks for the clarification. do the following:

1) take that ValueSetter out entirely. It wont do this sort of thing at all. (But it has a docs+examples page to tell you what it does do)

2) up at the top of the view, just upstream of the TimeRangePicker, wrap the TimerangePicker and all it's downstream modules in a URLLoader with the keepURLUpdated param set to True. URLLoader and TimeRangePicker afterward will look like this.

<module name="URLLoader" layoutPanel=”panel1_row1_col1” autoRun=”True”>
  <param name="keepURLUpdated">True</param>

  <module name=”TimeRangePicker”>
    <param name=”searchWhenChanged”>True</param>
    <param name=”default”>Last 24 hours</param>

    ... and all the other modules .... 

  </module>
</module>

And that'll do it. The URLLoader module with this param will actually monitor all the sideview modules downstream and modify the hash portion of the page URL to reflect their current state. Then when the user refreshes or an auto-refresh comes along, all selections are preserved. Of course, this will preserve the states for not just the TimeRangePicker and the Pulldown but also the TextField and the Checkbox.

0 Karma

IngloriousSplun
Communicator

I have a ValueSetter module downstream that maintains the Checkbox's value so that it remains checked as the page refreshes so the analysts know an event has been acknowledged. Should I remove that as well?

I need to do better at parsing your documentation and determining what to use for what situation, but I appreciate the immense amount of help you've been providing.

0 Karma

sideview
SplunkTrust
SplunkTrust

No you're good and you can leave that ValueSetter alone. From the search I take it that's a table-embedded ValueSetter and Checkbox, and you'll still want that there. And I don't think the embedded Checkbox will have any interaction with the URLLoader keepURLUpdated feature fwiw.

0 Karma

IngloriousSplun
Communicator

Is there a way to maintain persistence per Table. I have multiple tables on the dashboard, is there a plausible way for each table to have a different value that persists on refresh?

0 Karma

sideview
SplunkTrust
SplunkTrust

It's a little tedious, but if there's a bunch of them and they all would normally all have name params like "span", you have to change them to "span1", "span2", etc. As I think you've just discovered, if there's more than one with the same name param, the URL ends up only remembering the value from the most recent selection change.

0 Karma

IngloriousSplun
Communicator

My question was too vague, sorry. I'm actually referring to TimeRangePicker. I have it functioning correctly so each table can have its own span value exactly the way you noted, but for TimeRangePicker, when I change the time range on one table all update. I may just need to read back through the docs, but is there a way to maintain a custom time range for each table as well? I have each Table wrapped with URLLoader thinking that would maintain the time for each table, but that didn't work.

Thanks

<module name="URLLoader" layoutPanel="panel_row1_col1" autoRun=True>
  <param name="KeepURLUPdated">True</param>

  <module name="TimeRangePicker" layoutPanel="panel_row1_col1">
    <param name="searchWhenChanged">True</param>
    <param name="default">Last 24 hours</param>

    <module name="Pulldown" layoutPanel="panel_row1_col1">
...
0 Karma

sideview
SplunkTrust
SplunkTrust

Unfortunately since TimeRangePicker is deep down still the core Splunk module, albeit heavily patched and modified by Sideview Utils, it doesn't have an ability to override any "name". As such the only option that I can think of is to use a Pulldown as a timerange control. You may have noticed this but in addition to the 60 or so documentation pages with working examples, there are a ton of hidden "testcase" views in Sideview Utils. you might take a look at the "testcases_for_using_pulldown_as_timepicker" view. It's simple and limited but might serve.

0 Karma

IngloriousSplun
Communicator

To add to the above, it looks like URLLoader is interfering with my downstream ValueSetter that I use to maintain Checkbox value and its preventing it from remaining checked. My code looks like:

 <module name="URLLoader" layoutPanel="panel_row1_col1" autoRun=True>
   <param name="KeepURLUPdated">True</param>

   <module name="TimeRangePicker" layoutPanel="panel_row1_col1">
     <param name="searchWhenChanged">True</param>
     <param name="default">Last 24 hours</param>

     <module name="Pulldown" layoutPanel="panel_row1_col1">
       <param name="name">span1</param>
         <list>
           <param name="label">1h</param>
           <param name="value">1h</param>
        </list>
       </param>
        <module name="TextField" layoutPanel="panel_row1_col1">
          <param name="name">wild</param>
          <param name="label">Search</param>

          <module name="Search">
            <param name="search">`Test_Search(wild=$wild$,span=$span1$)` | eval Acknowledge="" | lookup myLookup myIdField OUTPUT state </param>
            <module name="Pager">
              <module name="Table">
                <module name="ValueSetter" group="row.fields.Acknowledge">
                  <param name="name">state</param>
                  <param name="value">$row.fields.state$</param>
                  <module name="Checkbox">
                    <param name="name">state</param>
                    <param name="onValue">Y</param>
                    <param name="offValue"></param>

                    <module name="Search">
                      <param name="search">| inputlookup myLookup | append [stats count | fields - count | eval myIdField="$row.fields.myIdField$" | eval state="$state$" ] | stats last(state) as state by myIdField | outputlookup myLookup</param>
...
0 Karma

sideview
SplunkTrust
SplunkTrust

Your casing on "KeepURLUPdated" is a little weird. The param name is "keepURLUpdated". Probably not contributing but I thought I'd mention. I'll investigate whether URLLoader's behavior is able to mess with the selection state of Table-embedded modules like your Checkbox. I wouldn't have thought so but it's possible.

0 Karma

sideview
SplunkTrust
SplunkTrust

If I understand right, where you're trying to get is -
-- User picks an arbitrary value X in the span pulldown, page then refreshes or is refreshed, and the X value is still selected in the span pulldown

If that's the case, the answer is to use the URLLoader module at the top, with its param keepURLUpdated set to True. If I'm interpreting your question correctly I will expand on this in an official answer.

0 Karma

IngloriousSplun
Communicator

Correct. If a user selects a span, say 1 hr, and the dashboard refreshes from a manual or auto-refresh I'd like that selection to stick so the query maintains that token. Same for the selection in TimeRangePicker.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...