Dashboards & Visualizations

AutoRun form from populated dropdown when only one item in field

alacercogitatus
SplunkTrust
SplunkTrust

So let's say I'm working on a modular input for GoogleApps. It's being designed to support multiple domains within the same MI. So I have a form dashboard with a dropdown that is populated with the different domains contained within the data. (example.com and example.org for ... example). So if you are a particular person running a single domain (example.com) I want the form to auto execute IF DROPDOWN_DOMAIN_COUNT == 1. Thoughts?

1 Solution

sideview
SplunkTrust
SplunkTrust

Well, I don't think there's any way to do it without writing some custom Javascript.

If you're using Sideview Utils there are a couple things that make this particular solution a lot easier to put together, although you still need some custom JS.

To back up a second, Sideview Utils is an app, available as a free download if you accept the license, from the Sideview site -- ( http://sideviewapps.com/apps/sideview-utils ). The app packages a number of custom modules as well as several other useful tools. Those custom modules can be used in place of certain other core Splunk modules, and they offer simpler but at the same time more powerful ways to build your Splunk views and dashboards.

Then, even considering the greatly expanded possibilities of what you can do with no custom code at all, past that there is always a blue-sky envelope past which you need custom code.

This requirement of yours is actually one of that latter kind. Customizing this involves monkeying with when the module framework allows a "push" to proceed and as it happens this is a card that the Splunk module framework plays pretty close to the vest.

Anyway, I put together a quick packaged example showing exactly this, including the custom JS to run it. It uses just the index=_internal data so it should run fine on your instance.

1) Here is the XML.

<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <label>Button Example</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="HTML" layoutPanel="viewHeader">
    <param name="html"><![CDATA[
    <h1>Button - An example allowing automatic submission conditionally</h1>
    ]]></param>
  </module>

  <!-- EXAMPLE BEGIN -->
  <module name="Search" layoutPanel="panel_row2_col1" autoRun="True">
    <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="splunkd" | dedup series | sort series | fields series</param>
    <param name="earliest">-1h</param>
    <param name="latest">now</param>

    <module name="Pulldown">
      <param name="name">series</param>
      <param name="label">Sourcetype:</param>
      <param name="template">series="$value$"</param>
      <param name="valueField">series</param>
      <param name="staticOptions"></param>

      <module name="Button">
        <param name="allowAutoSubmit">False</param>
        <param name="allowSoftSubmit">True</param>
        <param name="customBehavior">autoSubmitWhenOnlyOneValue</param>

        <module name="Search">
          <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" $series$ | stats min(eps) avg(eps) max(eps) </param>
          <param name="earliest">-1h</param>
          <param name="latest">now</param>

          <module name="Pager">

            <module name="Table"></module>

          </module>
        </module>
      </module>
    </module>
  </module>
  <!-- EXAMPLE END -->

</view>

2) Here is the Javascript which you should put in your app's appserver/static/application.js file

NOTE: that the value of the Pulldown's "name" param is embedded in this JS so you'll have to change that if/when you adapt this example for your own use.

if (typeof(Sideview)!="undefined") {

    Sideview.utils.declareCustomBehavior("autoSubmitWhenOnlyOneValue", function(buttonModule) {
        var methodReference = buttonModule.isReadyForContextPush.bind(buttonModule);

        buttonModule.isReadyForContextPush = function() {
            if (!this.allowAutoSubmit && !this.isPageLoadComplete()) {
                var context = this.getContext();
                // "series" is the value of the Pulldown's "name" param 
                var selectElement = context.get("series.element");
                if (selectElement.length>0);{
                    var numberOfOptions = selectElement[0].options.length;
                    return (numberOfOptions == 1);
                }
            }
            return methodReference();
        }
    });
}

3) And to artificially trigger the case when there's only one value in the Pulldown, change the Search upstream from the Pulldown so that it only ever matches one sourcetype, like so:

index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="splunkd" | dedup series | sort series | fields series

View solution in original post

sideview
SplunkTrust
SplunkTrust

Well, I don't think there's any way to do it without writing some custom Javascript.

If you're using Sideview Utils there are a couple things that make this particular solution a lot easier to put together, although you still need some custom JS.

To back up a second, Sideview Utils is an app, available as a free download if you accept the license, from the Sideview site -- ( http://sideviewapps.com/apps/sideview-utils ). The app packages a number of custom modules as well as several other useful tools. Those custom modules can be used in place of certain other core Splunk modules, and they offer simpler but at the same time more powerful ways to build your Splunk views and dashboards.

Then, even considering the greatly expanded possibilities of what you can do with no custom code at all, past that there is always a blue-sky envelope past which you need custom code.

This requirement of yours is actually one of that latter kind. Customizing this involves monkeying with when the module framework allows a "push" to proceed and as it happens this is a card that the Splunk module framework plays pretty close to the vest.

Anyway, I put together a quick packaged example showing exactly this, including the custom JS to run it. It uses just the index=_internal data so it should run fine on your instance.

1) Here is the XML.

<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <label>Button Example</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="HTML" layoutPanel="viewHeader">
    <param name="html"><![CDATA[
    <h1>Button - An example allowing automatic submission conditionally</h1>
    ]]></param>
  </module>

  <!-- EXAMPLE BEGIN -->
  <module name="Search" layoutPanel="panel_row2_col1" autoRun="True">
    <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="splunkd" | dedup series | sort series | fields series</param>
    <param name="earliest">-1h</param>
    <param name="latest">now</param>

    <module name="Pulldown">
      <param name="name">series</param>
      <param name="label">Sourcetype:</param>
      <param name="template">series="$value$"</param>
      <param name="valueField">series</param>
      <param name="staticOptions"></param>

      <module name="Button">
        <param name="allowAutoSubmit">False</param>
        <param name="allowSoftSubmit">True</param>
        <param name="customBehavior">autoSubmitWhenOnlyOneValue</param>

        <module name="Search">
          <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" $series$ | stats min(eps) avg(eps) max(eps) </param>
          <param name="earliest">-1h</param>
          <param name="latest">now</param>

          <module name="Pager">

            <module name="Table"></module>

          </module>
        </module>
      </module>
    </module>
  </module>
  <!-- EXAMPLE END -->

</view>

2) Here is the Javascript which you should put in your app's appserver/static/application.js file

NOTE: that the value of the Pulldown's "name" param is embedded in this JS so you'll have to change that if/when you adapt this example for your own use.

if (typeof(Sideview)!="undefined") {

    Sideview.utils.declareCustomBehavior("autoSubmitWhenOnlyOneValue", function(buttonModule) {
        var methodReference = buttonModule.isReadyForContextPush.bind(buttonModule);

        buttonModule.isReadyForContextPush = function() {
            if (!this.allowAutoSubmit && !this.isPageLoadComplete()) {
                var context = this.getContext();
                // "series" is the value of the Pulldown's "name" param 
                var selectElement = context.get("series.element");
                if (selectElement.length>0);{
                    var numberOfOptions = selectElement[0].options.length;
                    return (numberOfOptions == 1);
                }
            }
            return methodReference();
        }
    });
}

3) And to artificially trigger the case when there's only one value in the Pulldown, change the Search upstream from the Pulldown so that it only ever matches one sourcetype, like so:

index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="splunkd" | dedup series | sort series | fields series

sideview
SplunkTrust
SplunkTrust

Cool. Well to do it without Utils would be trickier. For one thing you don't have the allowAutoSubmit behavior that the Button has, and for another thing you don't have the "foo.element" key that the Pulldown drops into the context. Both of these Sideview-isms are saving us some significant custom code here and giving us a headstart.

Thinking about it, the "easiest" way is probably to BOTH patch a NullModule, implementing isReadyForContextPush on it, AND patch SearchSelectLister. Both are advanced areas and tricky to patch, so you'll want to have a pretty deep understanding of both.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Marked As Accepted. I'll play with this when I have a little bit more time, but I was also trying to avoid having 3rd party dependencies for this particular app. But I love sideviews anyway 😄

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...