Two flash-timeline in one dashboard

[KarunK]

Hi All,

I would like to have two flash-timeline preferably with postprocess. I have tested with two searches with out postprocess but the second flashtimeline is not working.

Can anyone help ?

I am looking for a Final dashboard which looks like below.

Flashtimeline1 EventsViewer1

Flashtimeline2 EventsViewer1

Thanks

<?xml version="1.0" encoding="UTF-8"?>
<view autoCancelInterval="90" decomposeIntentions="false" isPersistable="true" isSticky="false" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" stylesheet="application.css" template="dashboard.html">
   <label>Testing</label>
   <module name="SideviewUtils" layoutPanel="messaging" />
   <module name="AccountBar" layoutPanel="messaging" />
   <module name="AppBar" layoutPanel="navigationHeader" />
   <module name="Message" layoutPanel="viewHeader">
      <param name="maxSize">2</param>
      <param name="clearOnJobDispatch">False</param>
      <param name="filter">*</param>
   </module>
   <module name="Message" layoutPanel="viewHeader">
      <param name="maxSize">1</param>
      <param name="clearOnJobDispatch">True</param>
      <param name="filter">splunk.search.*</param>
   </module>
   <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
      <param name="search">|inputlookup address.csv</param>
      <module name="Pulldown">
         <param name="float">left</param>
         <param name="searchFieldsToDisplay">
            <list>
               <param name="label">service_name</param>
               <param name="value">service_name</param>
            </list>
         </param>
         <param name="name">service_name</param>
         <param name="label">Service</param>
         <param name="postProcess">| inputlookup service | table service_name | sort service_name</param>
         <module name="Pulldown">
            <param name="float">left</param>
            <param name="searchFieldsToDisplay">
               <list>
                  <param name="label">Live Channels</param>
                  <param name="value">channels</param>
               </list>
            </param>
            <param name="name">channels</param>
            <param name="label">Live Channels</param>
            <param name="postProcess">| inputlookup channel.csv | search service_name="$service_name$" | table channels| dedup channels | sort channels</param>
            <module name="TextField">
               <param name="float">left</param>
               <param name="label">Search</param>
               <param name="name">text</param>
               <module name="TimeRangePicker" layoutPanel="panel_row1_col1" autoRun="True">
                  <param name="default">Last 60 minutes</param>
                  <param name="searchWhenChanged">True</param>
                  <module name="SubmitButton">
                     <param name="allowSoftSubmit">True</param>
                     <module name="Search" layoutPanel="panel_row3_col1" group="Tier 1">
                        <param name="search">index="accesslog_extsqu" hostname="*ca*" eventtype="$service_name$" $channels$ $text$</param>
                        <module name="FlashTimeline">
                           <param name="height">100px</param>
                           <param name="width">100%</param>
                        </module>
                     </module>
                     <module name="Search" layoutPanel="panel_row4_col1" group="Tier 2">
                        <param name="search">index="accesslog_extsqu" hostname="*is*" eventtype="$service_name$" $channels$ $text$</param>
                        <module name="FlashTimeline">
                           <param name="height">100px</param>
                           <param name="width">100%</param>
                        </module>
                     </module>
                  </module>
               </module>
            </module>
         </module>
      </module>
   </module>
</view>

[sideview]

I'm afraid I have no good news.

1) The postprocess + FlashTimeline thing wont work. the endpoint the FlashTimeline module uses in the Rest API cannot account for postProcess searches.

2) As to why the second FlashTimeline doesn't render, I've investigated a bit and it seems like the way the FlashTimeline module is implemented, it will never work if there is more than one of them on the page. The modules pulls in a whole lot of external code, and the event listener that listens for that code to load, will only fire for the first FlashTimeline module on the page. The other ones will be DOA.

instead of two FlashTimelines I would use two FlashChart or JSChart modules, have them show timecharts, and wire up simple inline drilldown (following Sideview Utils examples).

I'll also try and circle back to this someday and see if I can easily patch the bug from Sideview Utils. But I doubt I'll be able to do anything safely.