All Apps and Add-ons

where/how to configure valueSetter so that i can pass earliest and latest thru redirector

kingsizebk
Path Finder

I need to have someone drilldown via a chart in the first view (that implements a timerangepicker) to a second view and i need to maintain the time range. i understand that i need timerangepicker, valuesetter and redirector working together on the first view and urlloader in the second view.

my problem is that no matter how or where i place the valuesetter configuration, the time ranges are never being passed. even when i put an HTML module immediately after the valuesetter, to display the name/value pairs that we set, I see nothing being set...

can someone help me to understand what i am doing wrong?

here is the first view configuration:

<view autoCancelInterval="90" isSticky="False" isVisible="true" onunloadCancelJobs="true" template="dashboard.html">
  <label>TXN Insight: Latency Summary</label>

  <module name="AccountBar" layoutPanel="appHeader" />

  <module name="AppBar" layoutPanel="appHeader" />

  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="URLLoader" layoutPanel="viewHeader" autoRun="True">

    <module name="HTML" layoutPanel="panel_row1_col1">
      <param name="html"><![CDATA[
<h1>This is the "Latency Summary" (a.k.a. "Red / Green") view, it is a work in progress.</h1><br/><h3>range: <font color="red">RED</font> means <font color="red">BAD</font> & range: <font color="green">GREEN</font> means <font color="green">GOOD</font></h3>
]]></param>
    </module>

    <module name="TimeRangePicker" layoutPanel="panel_row2_col1">
      <param name="label">Response Time by Operation</param>
      <param name="default">Last 60 minutes</param>

      <module name="TextField">
        <param name="width">250px</param>
        <param name="name">TxnId</param>
        <param name="template">$dpTxnId$</param>
        <param name="label">TxnId</param>

        <module name="TextField">
          <param name="name">Service</param>
          <param name="template">$Service$</param>
          <param name="width">250px</param>
          <param name="label">Service</param>

          <module name="TextField">
            <param name="name">Operation</param>
            <param name="label">Operation</param>
            <param name="width">250px</param>
            <param name="template">$Operation$</param>

            <module name="TextField">
              <param name="name">Version</param>
              <param name="label">Version</param>
              <param name="width">500px</param>
              <param name="template">$Version$</param>

              <module name="Search">
                <param name="search"><![CDATA[
index=dpi2 (sourcetype=dpAppLog operation) OR (sourcetype=dpSysLog Latency) NOT xmiStats | rex "<.*transaction>(?<dpTID>.*)</.*transaction>" | transaction dpTID maxspan=15m | search $TxnId$ $Service$ $Operation$ $Version$ Latency: | rex "Latency:(\s+\d+){11}\s+(?<rttc>\d+)" | streamstats avg(rttc) as avgRTTC | timechart avg(avgRTTC) as avgRTTC
]]></param>

                <module name="JobProgressIndicator" />

                <module name="ValueSetter">
                  <param name="name">stashedEarliest</param>
                  <param name="value">$search.timeRange.earliest$</param>

                  <module name="ValueSetter">
                    <param name="name">stashedLatest</param>
                    <param name="value">$search.timeRange.latest$</param>

                    <module name="HiddenChartFormatter">
                      <param name="primaryAxisTitle.text">Date / Time</param>
                      <param name="chart">line</param>
                      <param name="secondaryAxisTitle.text">Latency (ms)</param>
                      <param name="chartTitle">Round Trip Latency over Time</param>
                      <param name="chart.nullValueMode">connect</param>

                      <module name="JSChart">

                        <module name="Redirector">
                          <param name="url">txn_latency_detail</param>
                          <param name="url">txn_latency_detail</param>
                          <param name="arg.Service">$Service$</param>
                          <param name="arg.Operation">$Operation$</param>
                          <param name="arg.Version">$Version$</param>
                          <param name="arg.earliest">$stashedEarliest$</param>
                          <param name="arg.latest">$stashedLatest$</param>
                        </module>
                      </module>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>
1 Solution

sideview
SplunkTrust
SplunkTrust

Well I'm able to take your view verbatim, and just change the search enough so that it matches some data locally, and the $stashedEarliest$ trick seems to work just fine. When I click the chart, obviously I don't have a view called txn_latency_detail, but I see the earliest and latest arguments in the URL, and they're indeed the arguments straight from the TimeRangePicker, not the absolut-ified arguments from the timechart drilldown.

Minor notes:
1) Whenever you are passing a Sideview module's selection into a Redirector, make sure you use $Operation.rawValue$ instead of $Operation$. I made this fact a little more prominent in recent docs.

Short version: For all things that are plugged into the search language, use $foo$. For all things that are going to end up a) in URL's, or b) displayed to the user, use $foo.rawValue$. $foo$ gets templated, and backslash-escaped, whereas $foo$ does not. For the cases when your values have backslash characters or templating going on, you'll need to pass $foo.rawValue$ through Redirector for the prepopulation to work properly on the other side.

2) <param name="template">$Operation$</param> is redundant and you can delete all of those lines. They are templateless-templates. 😃

3) You can always use $name$ in any TextField and Pulldown params as shorthand for the value of the name param. This can save you from a few copy-and-paste errors in the long run because you can do for instance <param name="label">$name$</param>

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

So, in short, what you're seeing is actually correct. empty stashedEarliest and empty stashedLatest is exactly what an "all time" timerange should look like here.

0 Karma

sideview
SplunkTrust
SplunkTrust

the all/all convention is something that all the Sideview modules adopt as a convention. The reason that had to be done was basically for the general back button solution (there has to be some difference between an all-time timerange and the absence of a timerange or else back/forward button breaks for all-time timeranges). But all/all isn't actually legal to Splunk, so the convention can only run so deep in the framework. For instance it doesn't run so deep that the $search.timeRange.earliest$ value would be "all" when it goes into the ValueSetter...

0 Karma

kingsizebk
Path Finder

in "All time" both stashedEarliest and stashedLatest should be set to "all" - not empty - i thought...

0 Karma

sideview
SplunkTrust
SplunkTrust

Well it's odd but in Splunk the "All Time" timerange is actually the lack of any timerange at all, so in "All time" both stashedEarliest and stashedLatest should be empty. Is that the case? or is the absolut-ified timerange for the drilldown somehow appearing in the all time case?

0 Karma

kingsizebk
Path Finder

i was at Sideview version 2.3 but I have upgraded to 2.4.6 and still have the same issue. Can you try your test again, but use "All time" and see if that changes the behavior? I was just testing and found that if I set anything other than "All time" it does indeed work for me too.

0 Karma

sideview
SplunkTrust
SplunkTrust

Well I'm able to take your view verbatim, and just change the search enough so that it matches some data locally, and the $stashedEarliest$ trick seems to work just fine. When I click the chart, obviously I don't have a view called txn_latency_detail, but I see the earliest and latest arguments in the URL, and they're indeed the arguments straight from the TimeRangePicker, not the absolut-ified arguments from the timechart drilldown.

Minor notes:
1) Whenever you are passing a Sideview module's selection into a Redirector, make sure you use $Operation.rawValue$ instead of $Operation$. I made this fact a little more prominent in recent docs.

Short version: For all things that are plugged into the search language, use $foo$. For all things that are going to end up a) in URL's, or b) displayed to the user, use $foo.rawValue$. $foo$ gets templated, and backslash-escaped, whereas $foo$ does not. For the cases when your values have backslash characters or templating going on, you'll need to pass $foo.rawValue$ through Redirector for the prepopulation to work properly on the other side.

2) <param name="template">$Operation$</param> is redundant and you can delete all of those lines. They are templateless-templates. 😃

3) You can always use $name$ in any TextField and Pulldown params as shorthand for the value of the name param. This can save you from a few copy-and-paste errors in the long run because you can do for instance <param name="label">$name$</param>

0 Karma

sideview
SplunkTrust
SplunkTrust

No it does not actually. Good question. That's more becaue TimeRangePicker is not a Sideview module - it would be the TimeRangePicker's key that would have both styles of keys, and the whole thing is basically a Sideview convention.

0 Karma

kingsizebk
Path Finder

Does the ".rawValue" note also apply to valueSetter? e.g. if i set this:


stashedEarliest
$search.timeRange.earliest$

Do I need to do this:


$stashedEarliest.rawValue$

0 Karma

kingsizebk
Path Finder

Can you try your test again, but use "All time" and see if that changes the behavior? I was just testing and found that if I set anything other than "All time" it does indeed work for me too.

0 Karma

kingsizebk
Path Finder

. Later on tonight I can confirm the exact version number, but I know that I had the latestversion as of 2/1/2013...

0 Karma

sideview
SplunkTrust
SplunkTrust

Can I double check what version of Sideview Utils you're using?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...