All Apps and Add-ons

Using sideview variable for timechart range

Explorer

I'm trying (without much success) to get the HiddenChartFormatter to get charting.axisY.minimumNumber to set itself based on a sideview variable that is determined in a pulldown. My code looks like this:

<module name="Pulldown">
<param name="postProcess">chart min(value) as min by valuebuck</param>
<param name="name">minnum</param>
<param name="label">minnum</param>
<param name="staticFieldsToDisplay"></param>
<param name="searchFieldsToDisplay">
<list>
  <param name="label">min</param>
  <param name="value">min</param>
</list>
</param>
    <module name="Search" layoutPanel="panel_row2_col1">
        <param name="search">counter="Active Items" | timechart span=2h max(value)</param>
        <module name="HiddenChartFormatter">
          <param name="charting.chart">line</param>
          <param name="charting.axisY.minimumNumber">$minnum$</param>
          <module name="FlashChart">
            <param name="width">100%</param>
            <module name="ConvertToDrilldownSearch">
              <module name="ViewRedirector">
                <param name="viewTarget">flashtimeline</param>
              </module>
            </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
    </module>
</module>

Is this possible? What am I doing wrong?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You're very close. But HiddenChartFormatter is not a Sideview module and it cannot do any $foo$ substitution.

Although the Sideview modules allow $foo$ substitution pretty much anywhere, the core Splunk modules only allow $foo$ substitution in a couple very particular places and unfortunately that is not one of them.

Solution:

1) Simplest. Continue using HiddenChartFormatter to do the static keys like 'charting.chart', but remove the 'charting.axisY.minimumNumber' key from HiddenChartFormatter entirely. Then change the name param of your pulldown from minnum to 'charting.axisY.minimumNumber'.

2) remove the 'charting.axisY.minimumNumber' from HiddenChartFormatter, but use a ValueSetter module to convert your 'minnum' key into a 'charting.axisY.minimumNumber' key...

<module name="ValueSetter">
  <param name="name">charting.charting.axisY.minimumNumber</param>
  <param name="value">$minnum$</param>

Assumption: I assume there is a Search module upstream from the first Pulldown, that that Pulldown's postProcess param is working with. You seem to know what you're doing but this example isn't really complete without that Search module so I thought I'd point out the assumption for the benefit of other readers.

View solution in original post

SplunkTrust
SplunkTrust

Sorry - I got busy and didnt see your question there. And there's only a couple of us right now who answer the Sideview questions. See the solution below. Cheers.

0 Karma

SplunkTrust
SplunkTrust

You're very close. But HiddenChartFormatter is not a Sideview module and it cannot do any $foo$ substitution.

Although the Sideview modules allow $foo$ substitution pretty much anywhere, the core Splunk modules only allow $foo$ substitution in a couple very particular places and unfortunately that is not one of them.

Solution:

1) Simplest. Continue using HiddenChartFormatter to do the static keys like 'charting.chart', but remove the 'charting.axisY.minimumNumber' key from HiddenChartFormatter entirely. Then change the name param of your pulldown from minnum to 'charting.axisY.minimumNumber'.

2) remove the 'charting.axisY.minimumNumber' from HiddenChartFormatter, but use a ValueSetter module to convert your 'minnum' key into a 'charting.axisY.minimumNumber' key...

<module name="ValueSetter">
  <param name="name">charting.charting.axisY.minimumNumber</param>
  <param name="value">$minnum$</param>

Assumption: I assume there is a Search module upstream from the first Pulldown, that that Pulldown's postProcess param is working with. You seem to know what you're doing but this example isn't really complete without that Search module so I thought I'd point out the assumption for the benefit of other readers.

View solution in original post

Explorer

It works, awesome! Thank you very much Nick! There is indeed a Search module upstream but I left it out for brevity's sake.

0 Karma

Explorer

Two days now and no reply?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!