All Apps and Add-ons

Sideview Utils: Why my view using events module is missing vertical scroll bar, resulting in inability to see whole page?

chris_thuys
Path Finder

I have created a view that displays syslog records from three different searches in three different events modules. As a result, this uses more space than is available on the screen. With a standard dashboard, the web page will have a scrollbar to display the results at the bottom of the page. My view that I created does not have this scrollbar. I modeled my view on the events1_intro demo in sideview_utils which has the scrollbar.
any ideas on what I have missed. code provided below.

<view isSticky="False" isVisible="true" onunloadCancelJobs="true" template="dashboard.html">

<label>Overseer Enhanced</label>

<module name="AccountBar" layoutPanel="appHeader" />

<module name="AppBar" layoutPanel="appHeader" />

<module name="SideviewUtils" layoutPanel="appHeader" />

<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="maxSize">2</param>
<param name="clearOnJobDispatch">False</param>
</module>

<module name="HTML" layoutPanel="viewHeader">
<param name="html"><![CDATA[<h1>UNIX Syslog Viewer</h1> ]]>
</param>
</module>

<module name="TimeRangePicker" layoutPanel="splSearchControls-inline" autoRun="True">
<param name="default">Last 24 Hours</param>

<module name="Search" layoutPanel="panel_row1_col1">
<param name="search"><![CDATA[index=rsyslog | ``Syslog_alerts` |sort host, TimeGenerated]]>
</param>

<module name="HTML">
<param name="html"><![CDATA[<h3>Syslog Alerts</h3>]]>
</param>
<param name="maxRows">1</param>
</module>

<module name="SoftWrap">

<module name="RowNumbers">

<module name="Events" layoutPanel="panel_row1_col1">
<param name="resizeMode">fixed</param>
<param name="height">300px</param>
</module>
</module>
</module>

</module>

<module name="Search" layoutPanel="panel_row2_col1">
<param name="search"><![CDATA[index=rsyslog |``Syslog_warnings'| sort by host , -TimeGenerated]]>
</param>

<module name="HTML">
<param name="html"><![CDATA[<h2>SyslogWarnings</h2>]]>
</param>
</module>

<module name="Events" layoutPanel="panel_row2_col1" />
</module>

<module name="Search" layoutPanel="panel_row3_col1">
<param name="search"><![CDATA[index=rsyslog |``Syslog_info`| sort by host, TimeGenerated]]>
</param>

<module name="HTML" layoutPanel="panel_row3_col1">
<param name="html">&lt;h3&gt; Info Events&lt;/h3&gt;</param>
</module>

<module name="Events" layoutPanel="panel_row3_col1">
<param name="height">300px</param>
<param name="resizeMode">fixed</param>
</module>
</module>
</module>
</view>
0 Karma
1 Solution

chris_thuys
Path Finder

I resolved this issue myself by setting the height and setting resizeMode to fixed on each of the event modules.
I imagine the error may be a result of setting resizeMode to auto which then tries to set the bottom of the first event module window to the bottom of the viewport.

Feel free to clarify any of my answer.

View solution in original post

chris_thuys
Path Finder

I resolved this issue myself by setting the height and setting resizeMode to fixed on each of the event modules.
I imagine the error may be a result of setting resizeMode to auto which then tries to set the bottom of the first event module window to the bottom of the viewport.

Feel free to clarify any of my answer.

sideview
SplunkTrust
SplunkTrust

Sorry I missed this. Yes that is the solution. It's not proven to be a very wise choice, but the module's default resizeMode is such that it tries to expand down to the bottom edge of the screen, and have a scrollbar for its own content. And to avoid then having two scrollbars right next to eachother, the module itself actually turns off the overall page scrollbar. By and large though, people using the module for the first time are normally very confused by this, just as you were here. Possibly it should be changed although it creates the need for a migration script... (changing the param default would disrupt backwards compatibility for folks whose pages expect it to behave the old way.)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automated Threat Analysis: Available in ES Premier

Automated Threat Analysis: Centralize and Accelerate Phishing Investigations in Splunk Enterprise ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...