All Apps and Add-ons

Using sideview variable for timechart range

natrixia
Explorer

I'm trying (without much success) to get the HiddenChartFormatter to get charting.axisY.minimumNumber to set itself based on a sideview variable that is determined in a pulldown. My code looks like this:

<module name="Pulldown">
<param name="postProcess">chart min(value) as min by valuebuck</param>
<param name="name">minnum</param>
<param name="label">minnum</param>
<param name="staticFieldsToDisplay"></param>
<param name="searchFieldsToDisplay">
<list>
  <param name="label">min</param>
  <param name="value">min</param>
</list>
</param>
    <module name="Search" layoutPanel="panel_row2_col1">
        <param name="search">counter="Active Items" | timechart span=2h max(value)</param>
        <module name="HiddenChartFormatter">
          <param name="charting.chart">line</param>
          <param name="charting.axisY.minimumNumber">$minnum$</param>
          <module name="FlashChart">
            <param name="width">100%</param>
            <module name="ConvertToDrilldownSearch">
              <module name="ViewRedirector">
                <param name="viewTarget">flashtimeline</param>
              </module>
            </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
    </module>
</module>

Is this possible? What am I doing wrong?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

You're very close. But HiddenChartFormatter is not a Sideview module and it cannot do any $foo$ substitution.

Although the Sideview modules allow $foo$ substitution pretty much anywhere, the core Splunk modules only allow $foo$ substitution in a couple very particular places and unfortunately that is not one of them.

Solution:

1) Simplest. Continue using HiddenChartFormatter to do the static keys like 'charting.chart', but remove the 'charting.axisY.minimumNumber' key from HiddenChartFormatter entirely. Then change the name param of your pulldown from minnum to 'charting.axisY.minimumNumber'.

2) remove the 'charting.axisY.minimumNumber' from HiddenChartFormatter, but use a ValueSetter module to convert your 'minnum' key into a 'charting.axisY.minimumNumber' key...

<module name="ValueSetter">
  <param name="name">charting.charting.axisY.minimumNumber</param>
  <param name="value">$minnum$</param>

Assumption: I assume there is a Search module upstream from the first Pulldown, that that Pulldown's postProcess param is working with. You seem to know what you're doing but this example isn't really complete without that Search module so I thought I'd point out the assumption for the benefit of other readers.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Sorry - I got busy and didnt see your question there. And there's only a couple of us right now who answer the Sideview questions. See the solution below. Cheers.

0 Karma

sideview
SplunkTrust
SplunkTrust

You're very close. But HiddenChartFormatter is not a Sideview module and it cannot do any $foo$ substitution.

Although the Sideview modules allow $foo$ substitution pretty much anywhere, the core Splunk modules only allow $foo$ substitution in a couple very particular places and unfortunately that is not one of them.

Solution:

1) Simplest. Continue using HiddenChartFormatter to do the static keys like 'charting.chart', but remove the 'charting.axisY.minimumNumber' key from HiddenChartFormatter entirely. Then change the name param of your pulldown from minnum to 'charting.axisY.minimumNumber'.

2) remove the 'charting.axisY.minimumNumber' from HiddenChartFormatter, but use a ValueSetter module to convert your 'minnum' key into a 'charting.axisY.minimumNumber' key...

<module name="ValueSetter">
  <param name="name">charting.charting.axisY.minimumNumber</param>
  <param name="value">$minnum$</param>

Assumption: I assume there is a Search module upstream from the first Pulldown, that that Pulldown's postProcess param is working with. You seem to know what you're doing but this example isn't really complete without that Search module so I thought I'd point out the assumption for the benefit of other readers.

natrixia
Explorer

It works, awesome! Thank you very much Nick! There is indeed a Search module upstream but I left it out for brevity's sake.

0 Karma

natrixia
Explorer

Two days now and no reply?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...