I'm attempting to add a custom time range picker to a dashboard. I found this thread for using the Sideview Utils to do so:
http://answers.splunk.com/answers/77568/different-timerangepicker-values-for-different-reports-in-sa...
However, while the delimitation appears to be working, the $customTime[0]$ and $customTime[1]$ variables are not working/come out empty/null.
I believe the delimitation is working because I set the delimiter to a semi-colon, and $customTime$ displays a comma where $customTimeString$ displays a semi-colon.
When feeding this to a Search module farther down in the code, I get an "Invalid earliest_time" error (because $customTime[0]$ is empty/null).
What am I missing?
EDIT:
I put my work into a view all by itself and it still doesn't work, so I don't think it's something downstream in my original view that's causing the problem. Here's the complete code for the view:
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" stylesheet="application.css" template="dashboard.html">
<label>Test</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="SideviewUtils" layoutPanel="appHeader" />
<module name="Message" layoutPanel="messaging">
<param name="maxSize">1</param>
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
</module>
<module name="DashboardTitleBar" layoutPanel="viewHeader"/>
<module name="Message" layoutPanel="navigationHeader">
<param name="level">warn</param>
<param name="maxSize">1</param>
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
</module>
<module name="Pulldown" layoutPanel="panel_row1_col1" autoRun="True">
<param name="name">customTimeString</param>
<param name="float">left</param>
<param name="label">Time Range</param>
<param name="staticFieldsToDisplay">
<list>
<param name="label">Last 7 days</param>
<param name="value">-7d@d;@d</param>
</list>
<list>
<param name="label">Last 30 days</param>
<param name="value">-30d@d;@d</param>
</list>
<list>
<param name="label">Last 3 months</param>
<param name="selected">True</param>
<param name="value">-3mon@mon;@d</param>
</list>
</param>
<module name="ValueSetter">
<param name="delim">;</param>
<param name="name">customTime</param>
<param name="value">$customTimeString$</param>
<module name="HTML">
<param name="html"><![CDATA[
customTime: $customTime$<br />
customTimeString: $customTimeString$<br />
customTime array0: $customTime[0]$<br />
customTime array1: $customTime[1]$<br />
]]></param>
</module>
</module>
</module>
</view>
Needed two things:
Complete code:
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" stylesheet="application.css" template="dashboard.html">
<label>Test</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="SideviewUtils" layoutPanel="appHeader" />
<module name="Message" layoutPanel="messaging">
<param name="maxSize">1</param>
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
</module>
<module name="DashboardTitleBar" layoutPanel="viewHeader"/>
<module name="Message" layoutPanel="navigationHeader">
<param name="level">warn</param>
<param name="maxSize">1</param>
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
</module>
<module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
<module name="Pulldown" layoutPanel="panel_row1_col1" autoRun="True">
<param name="name">customTimeString</param>
<param name="float">left</param>
<param name="label">Time Range</param>
<param name="staticFieldsToDisplay">
<list>
<param name="label">Last 7 days</param>
<param name="value">-7d@d;@d</param>
</list>
<list>
<param name="label">Last 30 days</param>
<param name="value">-30d@d;@d</param>
</list>
<list>
<param name="label">Last 3 months</param>
<param name="selected">True</param>
<param name="value">-3mon@mon;@d</param>
</list>
</param>
<module name="ValueSetter">
<param name="delim">;</param>
<param name="name">customTime</param>
<param name="value">$customTimeString$</param>
<module name="HTML">
<param name="html"><![CDATA[
customTime: $customTime$<br />
customTimeString: $customTimeString$<br />
customTime array0: $customTime[0]$<br />
customTime array1: $customTime[1]$
]]></param>
</module>
</module>
</module>
</module>
</view>
Needed two things:
Complete code:
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" stylesheet="application.css" template="dashboard.html">
<label>Test</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="SideviewUtils" layoutPanel="appHeader" />
<module name="Message" layoutPanel="messaging">
<param name="maxSize">1</param>
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
</module>
<module name="DashboardTitleBar" layoutPanel="viewHeader"/>
<module name="Message" layoutPanel="navigationHeader">
<param name="level">warn</param>
<param name="maxSize">1</param>
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
</module>
<module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
<module name="Pulldown" layoutPanel="panel_row1_col1" autoRun="True">
<param name="name">customTimeString</param>
<param name="float">left</param>
<param name="label">Time Range</param>
<param name="staticFieldsToDisplay">
<list>
<param name="label">Last 7 days</param>
<param name="value">-7d@d;@d</param>
</list>
<list>
<param name="label">Last 30 days</param>
<param name="value">-30d@d;@d</param>
</list>
<list>
<param name="label">Last 3 months</param>
<param name="selected">True</param>
<param name="value">-3mon@mon;@d</param>
</list>
</param>
<module name="ValueSetter">
<param name="delim">;</param>
<param name="name">customTime</param>
<param name="value">$customTimeString$</param>
<module name="HTML">
<param name="html"><![CDATA[
customTime: $customTime$<br />
customTimeString: $customTimeString$<br />
customTime array0: $customTime[0]$<br />
customTime array1: $customTime[1]$
]]></param>
</module>
</module>
</module>
</module>
</view>
Curiously, your original XML works perfectly for me, on both Splunk 5.0.4, also on Splunk 6.0, with Sideview Utils 2.7, OR with Sideview Utils 1.3.5. One possible source of confusion is that you have to restart splunk search and possibly also forcibly clear browser cache after the Sideview Utils upgrade. Maybe it was a browser specific issue too - we never talked about browser. But at any rate, I'm glad you got it working.
An upgrade alone wasn't sufficient, I needed to add the URLLoader module:
<module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
Without that module, it breaks in a rather spectacular manner.
I'm including the full code (updated from my original post) below (since it's too long to put in this comment).
Yea. 1.3.5 is ancient. Over a year old. 45 releases ago, literally. The current version is 2.7 and you can get it from the sideview site here - http://sideviewapps.com/apps/sideview-utils That might be the problem somehow. Update to latest and see if that fixes it. Also post your downstream XML when you get a chance.
Maybe I have the wrong version of Sideview? I'm currently running 1.3.5 (downloaded a couple weeks ago, I thought from the Sideview site, but it might have come from Splunkbase), and there's no testcases_for_custom_timerange_pulldown view in it.
It all seems to work fine for me in Splunk 6. There is a hidden testcase view called "testcases_for_custom_timerange_pulldown" in the app and you can go to it manually. I also pasted in your config and it works fine in that the HTML module displays the two sides of the timerange arguments correctly. Can you paste in the rest of your config? perhaps you have something weird further downstream not pasted here.
It may be worth noting that I'm attempting to do this in Splunk 6. Perhaps something has changed in Splunk 6 that doesn't play nicely with this?
No, I don't have } in the code, I had retyped that manually for this post and typoed them. Fixed my original code to reflect what I had actually done in my XML.
Is it possibly just that in your $customTime[0}$
, you have an opening square bracket but a closing curly bracket? You should have $customTime[0]$
there instead. If the tokens in your Search module downstream are the same as these tokens in the HTML module, then that would explain it.
And if the typo is just on the tokens in the HTML module, can you include all the downstream config too?