Archive

Radial Gauge not Working in Advanced XML

Explorer

I have the following advanced XML to create a Radial Gauge in a dashboard, but it is not working. When I try to load the dashboard the top right says loading and nothing happens. I have run the search by hand with the subsearch it all works as expected but in a dashboard it seems to do nothing.

<?xml version='1.0' encoding='utf-8'?>
<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html">
  <label>All Service Error Rates</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">source="MSMetrics Socket" NOT ServiceName="Local Music" AND NOT ServiceName="Line-in" AND NOT ServiceName="iPod Dock"
                    | eval play_seconds_val = if(eventtype="play_seconds",CounterValue,0) 
                    | eval play_error_val = if(eventtype="play_errors",CounterValue,0) 
                    | eval play_hours = play_seconds_val/(60*60) 
                    | stats sum(play_hours) as sum_play_hours sum(play_error_val) as sum_play_errors  by ServiceName
                    | eval error_rate = round(if(sum_play_errors==0, 0, sum_play_errors/sum_play_hours),3)</param>
    <module name="PostProcess">
            <param name="search">search ServiceName="MY Service"| gauge error_rate 0 .125 .5 1 </param>
            <module name="HiddenChartFormatter">
                <param name="charting.chart">markerGauge</param>
                        <param name="charting.chart.style">minimal</param>
                    <param name="charting.chart.scaleX">1</param>
                <module name="FlashChart">
                    <param name="height">200px</param>
                </module>
            </module>
        </module>
  </module>
</view>
Tags (2)
1 Solution

SplunkTrust
SplunkTrust

Hi kjcorbin. The problem here is just that you're using the PostProcess module, and PostProcess is a Sideview Utils module.

You can
a) include the SideviewUtils module somewhere in the view out of the way, and then this will work fine.

or in your case, since you're not using $foo$ substitution in your PostProcess, and since that's the main advantage of my PostProcess module over Splunk's HiddenPostProcess module...

b) you can also replace PostProcess with HiddenPostProcess and that will get you going too.

However, it seems clear that you have the Sideview Utils app installed. If you did't have the app installed at all, you'd be getting a big alert saying that there's no PostProcess module. Whereas if you have the app, but you've neglected to include the SideviewUtils module on the page, you get Javascript errors when the page loads, and this derails the UI and leaves that "Loading..." hanging out up there. So anyway, given that you're already using Utils somewhere, I recommend going with a), and using it here too.

This is happening more often - where dashboard developers catch themselves thinking that Search or HTML, or PostProcess, are core Splunk modules... or that the patched drilldown keys on SimpleResultsTable are part of the core module rather than a patch on those modules done by Utils...

hth.

To briefly revisit the advantages of the PostProcess module, PostProcess can automatically substitute dollar tokens (eg $foo$) right into the search, just like the Search module. With Splunk's HiddenPostProcess module on the other hand, you cannot substitute any dynamic $foo$ tokens into the postprocess search at all, even with intentions. With the core module you're stuck with static postprocess searches always.

hth

View solution in original post

SplunkTrust
SplunkTrust

Hi kjcorbin. The problem here is just that you're using the PostProcess module, and PostProcess is a Sideview Utils module.

You can
a) include the SideviewUtils module somewhere in the view out of the way, and then this will work fine.

or in your case, since you're not using $foo$ substitution in your PostProcess, and since that's the main advantage of my PostProcess module over Splunk's HiddenPostProcess module...

b) you can also replace PostProcess with HiddenPostProcess and that will get you going too.

However, it seems clear that you have the Sideview Utils app installed. If you did't have the app installed at all, you'd be getting a big alert saying that there's no PostProcess module. Whereas if you have the app, but you've neglected to include the SideviewUtils module on the page, you get Javascript errors when the page loads, and this derails the UI and leaves that "Loading..." hanging out up there. So anyway, given that you're already using Utils somewhere, I recommend going with a), and using it here too.

This is happening more often - where dashboard developers catch themselves thinking that Search or HTML, or PostProcess, are core Splunk modules... or that the patched drilldown keys on SimpleResultsTable are part of the core module rather than a patch on those modules done by Utils...

hth.

To briefly revisit the advantages of the PostProcess module, PostProcess can automatically substitute dollar tokens (eg $foo$) right into the search, just like the Search module. With Splunk's HiddenPostProcess module on the other hand, you cannot substitute any dynamic $foo$ tokens into the postprocess search at all, even with intentions. With the core module you're stuck with static postprocess searches always.

hth

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!