All Apps and Add-ons

Using sideview variable for timechart range

natrixia
Explorer

I'm trying (without much success) to get the HiddenChartFormatter to get charting.axisY.minimumNumber to set itself based on a sideview variable that is determined in a pulldown. My code looks like this:

<module name="Pulldown">
<param name="postProcess">chart min(value) as min by valuebuck</param>
<param name="name">minnum</param>
<param name="label">minnum</param>
<param name="staticFieldsToDisplay"></param>
<param name="searchFieldsToDisplay">
<list>
  <param name="label">min</param>
  <param name="value">min</param>
</list>
</param>
    <module name="Search" layoutPanel="panel_row2_col1">
        <param name="search">counter="Active Items" | timechart span=2h max(value)</param>
        <module name="HiddenChartFormatter">
          <param name="charting.chart">line</param>
          <param name="charting.axisY.minimumNumber">$minnum$</param>
          <module name="FlashChart">
            <param name="width">100%</param>
            <module name="ConvertToDrilldownSearch">
              <module name="ViewRedirector">
                <param name="viewTarget">flashtimeline</param>
              </module>
            </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
    </module>
</module>

Is this possible? What am I doing wrong?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

You're very close. But HiddenChartFormatter is not a Sideview module and it cannot do any $foo$ substitution.

Although the Sideview modules allow $foo$ substitution pretty much anywhere, the core Splunk modules only allow $foo$ substitution in a couple very particular places and unfortunately that is not one of them.

Solution:

1) Simplest. Continue using HiddenChartFormatter to do the static keys like 'charting.chart', but remove the 'charting.axisY.minimumNumber' key from HiddenChartFormatter entirely. Then change the name param of your pulldown from minnum to 'charting.axisY.minimumNumber'.

2) remove the 'charting.axisY.minimumNumber' from HiddenChartFormatter, but use a ValueSetter module to convert your 'minnum' key into a 'charting.axisY.minimumNumber' key...

<module name="ValueSetter">
  <param name="name">charting.charting.axisY.minimumNumber</param>
  <param name="value">$minnum$</param>

Assumption: I assume there is a Search module upstream from the first Pulldown, that that Pulldown's postProcess param is working with. You seem to know what you're doing but this example isn't really complete without that Search module so I thought I'd point out the assumption for the benefit of other readers.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Sorry - I got busy and didnt see your question there. And there's only a couple of us right now who answer the Sideview questions. See the solution below. Cheers.

0 Karma

sideview
SplunkTrust
SplunkTrust

You're very close. But HiddenChartFormatter is not a Sideview module and it cannot do any $foo$ substitution.

Although the Sideview modules allow $foo$ substitution pretty much anywhere, the core Splunk modules only allow $foo$ substitution in a couple very particular places and unfortunately that is not one of them.

Solution:

1) Simplest. Continue using HiddenChartFormatter to do the static keys like 'charting.chart', but remove the 'charting.axisY.minimumNumber' key from HiddenChartFormatter entirely. Then change the name param of your pulldown from minnum to 'charting.axisY.minimumNumber'.

2) remove the 'charting.axisY.minimumNumber' from HiddenChartFormatter, but use a ValueSetter module to convert your 'minnum' key into a 'charting.axisY.minimumNumber' key...

<module name="ValueSetter">
  <param name="name">charting.charting.axisY.minimumNumber</param>
  <param name="value">$minnum$</param>

Assumption: I assume there is a Search module upstream from the first Pulldown, that that Pulldown's postProcess param is working with. You seem to know what you're doing but this example isn't really complete without that Search module so I thought I'd point out the assumption for the benefit of other readers.

natrixia
Explorer

It works, awesome! Thank you very much Nick! There is indeed a Search module upstream but I left it out for brevity's sake.

0 Karma

natrixia
Explorer

Two days now and no reply?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...