All Apps and Add-ons

Sideview delimitation ValueSetter array variables don't work

redc
Builder

I'm attempting to add a custom time range picker to a dashboard. I found this thread for using the Sideview Utils to do so:
http://answers.splunk.com/answers/77568/different-timerangepicker-values-for-different-reports-in-sa...

However, while the delimitation appears to be working, the $customTime[0]$ and $customTime[1]$ variables are not working/come out empty/null.

I believe the delimitation is working because I set the delimiter to a semi-colon, and $customTime$ displays a comma where $customTimeString$ displays a semi-colon.

When feeding this to a Search module farther down in the code, I get an "Invalid earliest_time" error (because $customTime[0]$ is empty/null).

What am I missing?


EDIT:

I put my work into a view all by itself and it still doesn't work, so I don't think it's something downstream in my original view that's causing the problem. Here's the complete code for the view:

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" stylesheet="application.css" template="dashboard.html">
  <label>Test</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader" />
  <module name="Message" layoutPanel="messaging">
    <param name="maxSize">1</param>
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
  </module>
  <module name="DashboardTitleBar" layoutPanel="viewHeader"/>
  <module name="Message" layoutPanel="navigationHeader">
    <param name="level">warn</param>
    <param name="maxSize">1</param>
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
  </module>
<module name="Pulldown" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="name">customTimeString</param>
  <param name="float">left</param>
  <param name="label">Time Range</param>
  <param name="staticFieldsToDisplay">
    <list>
      <param name="label">Last 7 days</param>
      <param name="value">-7d@d;@d</param>
    </list>
    <list>
      <param name="label">Last 30 days</param>
      <param name="value">-30d@d;@d</param>
    </list>
    <list>
      <param name="label">Last 3 months</param>
      <param name="selected">True</param>
      <param name="value">-3mon@mon;@d</param>
    </list>
  </param>
  <module name="ValueSetter">
    <param name="delim">;</param>
    <param name="name">customTime</param>
    <param name="value">$customTimeString$</param>
    <module name="HTML">
      <param name="html"><![CDATA[
  customTime: $customTime$<br />
  customTimeString: $customTimeString$<br />
  customTime array0: $customTime[0]$<br />
  customTime array1: $customTime[1]$<br />
  ]]></param>
    </module>
  </module>
  </module>
</view>
1 Solution

redc
Builder

Needed two things:

  1. Upgrade to Sideview Utils v2.7
  2. Add the URLLoader module to the view

Complete code:

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" stylesheet="application.css" template="dashboard.html">
  <label>Test</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader" />
  <module name="Message" layoutPanel="messaging">
    <param name="maxSize">1</param>
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
  </module>
  <module name="DashboardTitleBar" layoutPanel="viewHeader"/>
  <module name="Message" layoutPanel="navigationHeader">
    <param name="level">warn</param>
    <param name="maxSize">1</param>
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
  </module>
  <module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
    <module name="Pulldown" layoutPanel="panel_row1_col1" autoRun="True">
      <param name="name">customTimeString</param>
      <param name="float">left</param>
      <param name="label">Time Range</param>
      <param name="staticFieldsToDisplay">
        <list>
          <param name="label">Last 7 days</param>
          <param name="value">-7d@d;@d</param>
        </list>
        <list>
          <param name="label">Last 30 days</param>
          <param name="value">-30d@d;@d</param>
        </list>
        <list>
          <param name="label">Last 3 months</param>
          <param name="selected">True</param>
          <param name="value">-3mon@mon;@d</param>
        </list>
      </param>
      <module name="ValueSetter">
        <param name="delim">;</param>
        <param name="name">customTime</param>
        <param name="value">$customTimeString$</param>
        <module name="HTML">
          <param name="html"><![CDATA[
            customTime: $customTime$<br />
            customTimeString: $customTimeString$<br />
            customTime array0: $customTime[0]$<br />
            customTime array1: $customTime[1]$
          ]]></param>
        </module>
      </module>
    </module>
  </module>
</view>

View solution in original post

0 Karma

redc
Builder

Needed two things:

  1. Upgrade to Sideview Utils v2.7
  2. Add the URLLoader module to the view

Complete code:

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" stylesheet="application.css" template="dashboard.html">
  <label>Test</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader" />
  <module name="Message" layoutPanel="messaging">
    <param name="maxSize">1</param>
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
  </module>
  <module name="DashboardTitleBar" layoutPanel="viewHeader"/>
  <module name="Message" layoutPanel="navigationHeader">
    <param name="level">warn</param>
    <param name="maxSize">1</param>
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
  </module>
  <module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
    <module name="Pulldown" layoutPanel="panel_row1_col1" autoRun="True">
      <param name="name">customTimeString</param>
      <param name="float">left</param>
      <param name="label">Time Range</param>
      <param name="staticFieldsToDisplay">
        <list>
          <param name="label">Last 7 days</param>
          <param name="value">-7d@d;@d</param>
        </list>
        <list>
          <param name="label">Last 30 days</param>
          <param name="value">-30d@d;@d</param>
        </list>
        <list>
          <param name="label">Last 3 months</param>
          <param name="selected">True</param>
          <param name="value">-3mon@mon;@d</param>
        </list>
      </param>
      <module name="ValueSetter">
        <param name="delim">;</param>
        <param name="name">customTime</param>
        <param name="value">$customTimeString$</param>
        <module name="HTML">
          <param name="html"><![CDATA[
            customTime: $customTime$<br />
            customTimeString: $customTimeString$<br />
            customTime array0: $customTime[0]$<br />
            customTime array1: $customTime[1]$
          ]]></param>
        </module>
      </module>
    </module>
  </module>
</view>
0 Karma

sideview
SplunkTrust
SplunkTrust

Curiously, your original XML works perfectly for me, on both Splunk 5.0.4, also on Splunk 6.0, with Sideview Utils 2.7, OR with Sideview Utils 1.3.5. One possible source of confusion is that you have to restart splunk search and possibly also forcibly clear browser cache after the Sideview Utils upgrade. Maybe it was a browser specific issue too - we never talked about browser. But at any rate, I'm glad you got it working.

0 Karma

redc
Builder

An upgrade alone wasn't sufficient, I needed to add the URLLoader module:

<module name="URLLoader" layoutPanel="viewHeader" autoRun="True">

Without that module, it breaks in a rather spectacular manner.

I'm including the full code (updated from my original post) below (since it's too long to put in this comment).

0 Karma

sideview
SplunkTrust
SplunkTrust

Yea. 1.3.5 is ancient. Over a year old. 45 releases ago, literally. The current version is 2.7 and you can get it from the sideview site here - http://sideviewapps.com/apps/sideview-utils That might be the problem somehow. Update to latest and see if that fixes it. Also post your downstream XML when you get a chance.

0 Karma

redc
Builder

@sideview -

Maybe I have the wrong version of Sideview? I'm currently running 1.3.5 (downloaded a couple weeks ago, I thought from the Sideview site, but it might have come from Splunkbase), and there's no testcases_for_custom_timerange_pulldown view in it.

0 Karma

sideview
SplunkTrust
SplunkTrust

It all seems to work fine for me in Splunk 6. There is a hidden testcase view called "testcases_for_custom_timerange_pulldown" in the app and you can go to it manually. I also pasted in your config and it works fine in that the HTML module displays the two sides of the timerange arguments correctly. Can you paste in the rest of your config? perhaps you have something weird further downstream not pasted here.

0 Karma

redc
Builder

It may be worth noting that I'm attempting to do this in Splunk 6. Perhaps something has changed in Splunk 6 that doesn't play nicely with this?

0 Karma

redc
Builder

No, I don't have } in the code, I had retyped that manually for this post and typoed them. Fixed my original code to reflect what I had actually done in my XML.

0 Karma

sideview
SplunkTrust
SplunkTrust

Is it possibly just that in your $customTime[0}$, you have an opening square bracket but a closing curly bracket? You should have $customTime[0]$ there instead. If the tokens in your Search module downstream are the same as these tokens in the HTML module, then that would explain it.

And if the typo is just on the tokens in the HTML module, can you include all the downstream config too?

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...