After the Splunk 5 upgrade, a dashboard using a Pulldown module malfunctioned. I'm using Sideview Utils 1.3.5. The specific error msg is "ERROR - Pulldown is configured statically but with only a single static option."
I also get various errors when saving the view:
"Misconfigured view 'uit_usage' - Unknown parameter 'valueField' is defined for module Pulldown. Make sure the parameter is specified in Pulldown.conf."
"Misconfigured view 'uit_usage' - Unknown parameter 'staticOptions' is defined for module Pulldown. Make sure the parameter is specified in Pulldown.conf"
Perhaps Sideview utils needs to be reinstalled?
here's the view xml:
<?xml version='1.0' encoding='utf-8'?>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="SavedSearch" layoutPanel="panel_row1_col1" autoRun="True">
<param name="name">UIT Usage</param>
<module name="HTML">
<param name="html"><![CDATA[
<div style="font-weight:bold; font-size:1.2em">Top 30 Orgs by usage over the last 7 days</div>
]]></param>
<!--
<param name="html"><![CDATA[
<div style="font-weight:bold; font-size:1.2em">Top 30 Orgs by usage during the 13.2 UIT period</div>
]]></param>
-->
</module>
<module name="Pulldown">
<param name="name">orgList</param>
<param name="label">See daily counts by choosing an Org below or from this option list</param>
<param name="postProcess">dedup applog_orgName | sort applog_orgName</param>
<param name="valueField">applog_orgName</param>
<param name="staticOptions"></param>
<module name="PostProcess" layoutPanel="panel_row1_col1_grp1">
<param name="search">chart count over applog_orgName | sort 30 count desc</param>
<module name="HiddenChartFormatter">
<param name="charting.axisTitleY.text">Organization</param>
<param name="charting.legend.placement">none</param>
<param name="charting.chart">bar</param>
<param name="charting.axisTitleX.text">Number of Commands</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">500px</param>
<!-- changing the drill down to show daily counts for the selected org -->
<module name="PostProcess" layoutPanel="panel_row2_col1">
<param name="search">where applog_orgName="$click.value$" | timechart count by applog_orgName span=1h</param>
<module name="SimpleResultsHeader">
<param name="entityName">results</param>
<param name="headerFormat">Daily usage for $click.value$</param>
</module>
<module name="HiddenChartFormatter">
<param name="charting.axisTitleY.text">Commands</param>
<param name="charting.legend.placement">none</param>
<param name="charting.chart">column</param>
<param name="charting.axisTitleX.text">Day</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">200px</param>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="PostProcess" layoutPanel="panel_row2_col2">
<param name="search">where applog_orgName="$orgList$" | timechart count by applog_orgName span=1h</param>
<module name="SimpleResultsHeader">
<param name="entityName">results</param>
<param name="headerFormat">Daily usage for $orgList$</param>
</module>
<module name="HiddenChartFormatter">
<param name="charting.axisTitleY.text">Commands</param>
<param name="charting.legend.placement">none</param>
<param name="charting.chart">column</param>
<param name="charting.axisTitleX.text">Day</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">200px</param>
</module>
</module>
</module>
</module>
</module>
Well your view is using params that only exist in Sideview Utils 2.X, so clearly that app has a dependency on Sideview Utils 2.X, and not 1.3.5.
I'm thinking that in your upgrade to Splunk 5, you inadvertently reverted from a recent Sideview Utils to the very old 1.3.5 version?
http://sideviewapps.com/apps/sideview-utils
and if you want to read the release notes you can see valueField
and staticOptions
in there:
http://sideviewapps.com/apps/sideview-utils/release-notes/
and remember to get on the mailing list so you can get a litlte email when there are new releases.
http://sideviewapps.com/apps/sideview-utils/mailing-list/
Well your view is using params that only exist in Sideview Utils 2.X, so clearly that app has a dependency on Sideview Utils 2.X, and not 1.3.5.
I'm thinking that in your upgrade to Splunk 5, you inadvertently reverted from a recent Sideview Utils to the very old 1.3.5 version?
http://sideviewapps.com/apps/sideview-utils
and if you want to read the release notes you can see valueField
and staticOptions
in there:
http://sideviewapps.com/apps/sideview-utils/release-notes/
and remember to get on the mailing list so you can get a litlte email when there are new releases.
http://sideviewapps.com/apps/sideview-utils/mailing-list/
That must be it. I looked back in my notes from a year ago when sideview utils was first installed and I had v2.2.2. I have no idea how 1.3.5 got installed. I have informed IT and I'm sure once the new version gets installed things will start working. Many thanks!
Does anyone know if the sideview utils Pulldown module can use a saved search? I've been tinkering with this and it appears like the Pulldown is not recognizing the upstream SavedSearch.