All Apps and Add-ons

Single Value decorations broken in v6.3.x

Lucas_K
Motivator

We've had quite a few dashboards based on the single value decorations, specifically the splunk icons (ticks, crosses etc).

In 6.3.1 these are now formatted incorrectly and the tops of the icons are cut off. Even in the examples.

alt text

Also text below the icons has a large amount of white space below it. (example below)

alt text

The above used the following code simplexml options.

    <single>
        <search base="globalSearch">
          <query>search "Dos Attack"=* | rangemap field=value low=0-1 elevated=2-9 severe=10-100 default=none</query>
        </search>
        <option name="classField">range</option>
        <option name="field">range</option>
        <option name="additionalClass">icon-only</option>
        <option name="underLabel">Dos Attack Check</option>
        <option name="refresh.time.visible">false</option>
      </single>

Does anyone know how to fix this?

0 Karma
1 Solution

Lucas_K
Motivator

ok fixed via a css update.

.single-value:before {
    font-family: "Splunk Icons";
    font-style: normal;
    font-weight: normal;
    text-decoration: inherit;
    font-size: 48px;
    position: absolute;
    width: 100%;
    top: 15%;

}

View solution in original post

Lucas_K
Motivator

ok fixed via a css update.

.single-value:before {
    font-family: "Splunk Icons";
    font-style: normal;
    font-weight: normal;
    text-decoration: inherit;
    font-size: 48px;
    position: absolute;
    width: 100%;
    top: 15%;

}

seanel
Path Finder

It's because of the changes they have made to the single value visualisation which basically falls into 2 broad categories:

  1. All kinds of cool trending, colouring by trend etc can now be done in a single value's xml properties etc if you build the search to be more of a timechart than a single value.
  2. The property is set to 115px by default

So if you rebuild the search as described in 1. you can actually stop using the single value decorecorations css as most of that functionality is now built-in and some of the tricks you used to get it running are now deprecated.

If you want a quick fix - just use the height property to make them small again

See here for more info: http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/PanelreferenceforSimplifiedXML#single

Lucas_K
Motivator

The height property only adjusts the whitespace below the icon.

Height setting as marked
alt text

The problem is that the functionality no longer exists in the new single value option.

There is no way with the new single value to have an icon only and no text. Even just up and down.

The use case for this is that we use rolled up column headers which allows an "at a glace" visual cue to be able to tell if there is anything to investigate further down the dashboard.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Just curious... what is your "zoom level" in your browser? Have you managed to zoom in to 110% etc?

Have you tried the ctrl + f5 "Cache Refresh" trick to refresh all resources directly from server?

What happens if you resize your browser window? Does it redraw items a bit differently?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...