Dashboards & Visualizations
Highlighted

Advanced listener with timepicker

Path Finder

I just wrote up a custom web page that provides a search bar and drop down menus over the Google maps app. I am pretty pleased with it, but there is one thing that is not working how I want it to. When I select menu items from left to right, they re-populate the down stream filters as expected. However, they do not populate them up stream. I am most concerned because I would really like to see the time picker reload the previous menus.

I suspect that the SearchLinkLister applyOuterIntentionsToInternalSearch parameter is driving the results down stream (most of my code is extracted from the UI examples app). However there does not seem to be a way to "applyOuterIntentionsToExternalSearch". Is there possibly some other way to accomplish this?

Thank you in advance,

Jim

[root@awesome views]# more test.xml

<?xml version="1.0"?>

<!-- autoCancelInterval is set here to 100 -->




*
False
1


Search
*
False

<!-- sample HiddenIntention that inserts index="vpn_access"  -->
<module name="HiddenIntention">
  <param name="intention">
    <param name="name">addterm</param>
    <param name="arg">
      <param name="index">vpn_access</param>
    </param>
    <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
    <param name="flags"><list>indexed</list></param>
  </param>

  <!-- sample HiddenIntention that inserts element_name="*" -->
  <module name="HiddenIntention">
    <param name="intention">
      <param name="name">addterm</param>
      <param name="arg">
        <param name="element_name">*</param>
      </param>
      <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
      <param name="flags"><list>indexed</list></param>
    </param>

    <!-- sample HiddenIntention that inserts group_policy="*" -->
    <module name="HiddenIntention">
      <param name="intention">
        <param name="name">addterm</param>
        <param name="arg">
          <param name="group_policy">*</param>
        </param>
        <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
        <param name="flags"><list>indexed</list></param>
      </param>

      <!-- sample HiddenIntention that inserts username="*" -->
      <module name="HiddenIntention">
        <param name="intention">
          <param name="name">addterm</param>
          <param name="arg">
            <param name="username">*</param>
          </param>
          <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
          <param name="flags"><list>indexed</list></param>
        </param>


        <module name="SearchSelectLister" layoutPanel="splSearchControls-inline">
          <param name="label">VPN Concentrator</param>
          <param name="settingToCreate">vpn_device_setting</param>
          <param name="search">index=vpn_access element_name=* | stats count by element_name | sort element_name</param>
          <param name="searchWhenChanged">True</param>
          <param name="staticFieldsToDisplay">
            <list>
              <param name="label">ALL</param>
              <param name="value">*</param>
            </list>
          </param>
          <param name="selected">ALL</param>
          <param name="searchFieldsToDisplay">
            <list>
              <param name="label">element_name</param>
              <param name="value">element_name</param>
            </list>
          </param>
            <module name="ConvertToIntention">
              <param name="settingToConvert">vpn_device_setting</param>
              <param name="intention">
                <param name="name">stringreplace</param>
                <param name="arg">
                  <param name="element_name">
                    <param name="fillOnEmpty">True</param>
                    <param name="value">$target$</param>
                  </param>
                </param>
              </param>

              <module name="SearchSelectLister" layoutPanel="splSearchControls-inline">
                <param name="label">Group Policy</param>
                <param name="settingToCreate">group_policy_setting</param>
                <param name="search">index=vpn_access element_name=$element_name$ | stats count by group_policy | sort group_policy</param>
                <param name="applyOuterIntentionsToInternalSearch">True</param>
                <param name="staticFieldsToDisplay">
                  <list>
                    <param name="label">ALL</param>
                    <param name="value">*</param>
                  </list>
                </param>
                <param name="searchFieldsToDisplay">
                  <list>
                    <param name="label">group_policy</param>
                    <param name="value">group_policy</param>
                  </list>
                </param>
                <module name="ConvertToIntention">
                  <param name="settingToConvert">group_policy_setting</param>
                  <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                      <param name="group_policy">
                        <param name="fillOnEmpty">True</param>
                        <param name="value">$target$</param>
                      </param>
                    </param>
                  </param>

                  <module name="SearchSelectLister" layoutPanel="splSearchControls-inline">
                    <param name="label">Username</param>
                    <param name="settingToCreate">username_policy_setting</param>
                    <param name="search">index=vpn_access element_name=$element_name$ group_policy=$group_policy$ | stats count by username | sort username</param>
                    <param name="applyOuterIntentionsToInternalSearch">True</param>
                    <param name="staticFieldsToDisplay">
                      <list>
                        <param name="label">ALL</param>
                        <param name="value">*</param>
                      </list>
                    </param>
                    <param name="searchFieldsToDisplay">
                      <list>
                        <param name="label">username</param>
                        <param name="value">username</param>
                      </list>
                    </param>
                    <module name="ConvertToIntention">
                      <param name="settingToConvert">username_policy_setting</param>
                      <param name="intention">
                        <param name="name">stringreplace</param>
                        <param name="arg">
                          <param name="username">
                            <param name="fillOnEmpty">True</param>
                            <param name="value">$target$</param>
                          </param>
                        </param>
                      </param>


                      <module name="TimeRangePicker">
                        <param name="label">Time Picker</param>
                        <param name="selected">Last 4 hours</param>
                        <param name="searchWhenChanged">True</param>
                        <module name="SubmitButton">
                          <param name="allowSoftSubmit">True</param>


                          <module name="GenericHeader" layoutPanel="graphArea">
                            <param name="label">Google Map</param>
                          </module>
                          <module name="HiddenSearch" layoutPanel="graphArea" autoRun="true">
                              <param name="search">index=vpn_access element_name=$element_name$ group_policy=$group_policy$ username=$username$ | localop | geoip public_ip</param>
                              <module name="GoogleMaps">
                                <param name="height">500px</param>
                                <param name="mapType">roadmap</param>
                                <param name="scrollwheel">off</param>
                            </module>
                        </module>

                      </module>

                      <module name="Message" layoutPanel="graphArea">
                        <param name="filter">splunk.search.job</param>
                        <param name="clearOnJobDispatch">True</param>
                        <param name="maxSize">2</param>
                        <module name="JobStatus">
                          <param name="resultsLink">
                            <param name="popup">True</param>
                            <param name="viewTarget">report_builder_define_data</param>
                            <param name="transformedResultsViewTarget">report_builder_format_report</param>
                          </param>
                          <module name="FlashTimeline" layoutPanel="graphArea">
                            <param name="height">180px</param>
                            <param name="width">100%</param>
                            <module name="TitleBar" layoutPanel="viewHeader"/>
                            <module name="FieldPicker" layoutPanel="sidebar">
                              <param name="fields">host sourcetype source</param>
                              <param name="link">
                                <param name="view">report_builder_format_report</param>
                              </param>
                              <module name="Message" layoutPanel="resultsAreaLeft">
                                <param name="filter">pageControls</param>
                                <param name="clearOnJobDispatch">True</param>
                                <param name="maxSize">1</param>
                              </module>
                              <module name="Count" layoutPanel="pageControls">
                                <param name="options">
                                  <list>
                                    <param name="text">10</param>
                                    <param name="value">10</param>
                                  </list>
                                  <list>
                                    <param name="text">20</param>
                                    <param name="value">20</param>
                                  </list>
                                  <list>
                                    <param name="text">50</param>
                                    <param name="selected">True</param>
                                    <param name="value">50</param>
                                  </list>
                                </param>
                                <module name="ButtonSwitcher" layoutPanel="pageControls">
                                  <param name="mode">independent</param>
                                  <param name="selected">splIcon-events-list</param>
                                  <param name="disableOnNull">True</param>
                                  <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-list" altTitle="Events List">
                                    <param name="entityLabel">events</param>
                                    <param name="entityName">events</param>
                                    <module name="Paginator" layoutPanel="pageControls">
                                      <param name="entityName">events</param>
                                      <param name="maxPages">10</param>
                                      <module name="SoftWrap" layoutPanel="resultsOptions">
                                        <param name="enable">True</param>
                                        <module name="RowNumbers">
                                          <module name="MaxLines">
                                            <param name="options">
                                              <list>
                                                <param name="text">5</param>
                                                <param name="selected">True</param>
                                                <param name="value">5</param>
                                              </list>
                                              <list>
                                                <param name="text">10</param>
                                                <param name="value">10</param>
                                              </list>
                                              <list>
                                                <param name="text">20</param>
                                                <param name="value">20</param>
                                              </list>
                                              <list>
                                                <param name="text">50</param>
                                                <param name="value">50</param>
                                              </list>
                                              <list>
                                                <param name="text">100</param>
                                                <param name="value">100</param>
                                              </list>
                                              <list>
                                                <param name="text">200</param>
                                                <param name="value">200</param>
                                              </list>
                                              <list>
                                                <param name="text">All</param>
                                                <param name="value">0</param>
                                              </list>
                                            </param>
                                            <module name="Segmentation">
                                              <param name="options">
                                                <list>
                                                  <param name="text">inner</param>
                                                  <param name="selected">True</param>
                                                  <param name="value">inner</param>
                                                </list>
                                                <list>
                                                  <param name="text">outer</param>
                                                  <param name="value">outer</param>
                                                </list>
                                                <list>
                                                  <param name="text">full</param>
                                                  <param name="value">full</param>
                                                </list>
                                                <list>
                                                  <param name="text">raw</param>
                                                  <param name="value">raw</param>
                                                </list>
                                              </param>
                                              <module name="EventsViewer" layoutPanel="resultsAreaLeft">
                                                <param name="segmentation">full</param>
                                                <param name="reportFieldLink">report_builder_format_report</param>
                                              </module>
                                            </module>
                                          </module>
                                        </module>
                                      </module>
                                    </module>
                                  </module>
                                  <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-table" altTitle="Events Table">
                                    <param name="entityLabel">events</param>
                                    <param name="entityName">events</param>
                                    <module name="Paginator" layoutPanel="pageControls">
                                      <param name="count">50</param>
                                      <param name="entityName">events</param>
                                      <param name="maxPages">10</param>
                                      <module name="RowNumbers" layoutPanel="resultsOptions">
                                        <module name="DataOverlay" layoutPanel="resultsAreaLeft">
                                          <module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
                                            <param name="entityName">events</param>
                                          </module>
                                        </module>
                                      </module>
                                    </module>
                                  </module>
                                  <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-results-table" altTitle="Results Table">
                                    <param name="entityLabel">results</param>
                                    <param name="entityName">results</param>
                                    <module name="EnablePreview" group="show" layoutPanel="resultsOptions">
                                      <param name="enable">True</param>
                                      <module name="Paginator" layoutPanel="pageControls">
                                        <param name="count">50</param>
                                        <param name="entityName">results</param>
                                        <param name="maxPages">10</param>
                                        <module name="RowNumbers" layoutPanel="resultsOptions">
                                          <module name="DataOverlay" layoutPanel="resultsAreaLeft">
                                            <module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
                                              <param name="entityName">results</param>
                                            </module>
                                          </module>
                                        </module>
                                      </module>
                                    </module>
                                  </module>
                                </module>
                              </module>
                              <module name="MultiFieldViewer">
                                <param name="link">
                                  <param name="view">report_builder_format_report</param>
                                </param>
                              </module>
                              <module name="SuggestedFieldViewer">
                                <param name="minDistinctCount">1</param>
                                <param name="minFrequency">0.5</param>
                                <param name="maxFields">50</param>
                                <param name="exclude">
                                  <list>^date_.*</list>
                                </param>
                                  <param name="link">
                                  <param name="view">report_builder_format_report</param>
                                </param>
                              </module>
                            </module>
                          </module>
                        </module>
                      </module>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>



[root@awesome views]#

Tags (1)
0 Karma
Highlighted

Re: Advanced listener with timepicker

SplunkTrust
SplunkTrust

If you want the other pulldowns to update when the user changes the selected time range, all you have to do is put the TimeRangePicker module upstream from the SearchSelectListers. This will also change the visible order on the page, but you'll find that the new order after the change will be more intuitive.

As a general rule, Splunk UI modules really can not send any information upstream at all. Fortunately the answer is almost always to simply reorder them.

View solution in original post

0 Karma