Dashboards & Visualizations

AutoRun form from populated dropdown when only one item in field

SplunkTrust
SplunkTrust

So let's say I'm working on a modular input for GoogleApps. It's being designed to support multiple domains within the same MI. So I have a form dashboard with a dropdown that is populated with the different domains contained within the data. (example.com and example.org for ... example). So if you are a particular person running a single domain (example.com) I want the form to auto execute IF DROPDOWN_DOMAIN_COUNT == 1. Thoughts?

1 Solution

SplunkTrust
SplunkTrust

Well, I don't think there's any way to do it without writing some custom Javascript.

If you're using Sideview Utils there are a couple things that make this particular solution a lot easier to put together, although you still need some custom JS.

To back up a second, Sideview Utils is an app, available as a free download if you accept the license, from the Sideview site -- ( http://sideviewapps.com/apps/sideview-utils ). The app packages a number of custom modules as well as several other useful tools. Those custom modules can be used in place of certain other core Splunk modules, and they offer simpler but at the same time more powerful ways to build your Splunk views and dashboards.

Then, even considering the greatly expanded possibilities of what you can do with no custom code at all, past that there is always a blue-sky envelope past which you need custom code.

This requirement of yours is actually one of that latter kind. Customizing this involves monkeying with when the module framework allows a "push" to proceed and as it happens this is a card that the Splunk module framework plays pretty close to the vest.

Anyway, I put together a quick packaged example showing exactly this, including the custom JS to run it. It uses just the index=_internal data so it should run fine on your instance.

1) Here is the XML.

<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <label>Button Example</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="HTML" layoutPanel="viewHeader">
    <param name="html"><![CDATA[
    <h1>Button - An example allowing automatic submission conditionally</h1>
    ]]></param>
  </module>

  <!-- EXAMPLE BEGIN -->
  <module name="Search" layoutPanel="panel_row2_col1" autoRun="True">
    <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="splunkd" | dedup series | sort series | fields series</param>
    <param name="earliest">-1h</param>
    <param name="latest">now</param>

    <module name="Pulldown">
      <param name="name">series</param>
      <param name="label">Sourcetype:</param>
      <param name="template">series="$value$"</param>
      <param name="valueField">series</param>
      <param name="staticOptions"></param>

      <module name="Button">
        <param name="allowAutoSubmit">False</param>
        <param name="allowSoftSubmit">True</param>
        <param name="customBehavior">autoSubmitWhenOnlyOneValue</param>

        <module name="Search">
          <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" $series$ | stats min(eps) avg(eps) max(eps) </param>
          <param name="earliest">-1h</param>
          <param name="latest">now</param>

          <module name="Pager">

            <module name="Table"></module>

          </module>
        </module>
      </module>
    </module>
  </module>
  <!-- EXAMPLE END -->

</view>

2) Here is the Javascript which you should put in your app's appserver/static/application.js file

NOTE: that the value of the Pulldown's "name" param is embedded in this JS so you'll have to change that if/when you adapt this example for your own use.

if (typeof(Sideview)!="undefined") {

    Sideview.utils.declareCustomBehavior("autoSubmitWhenOnlyOneValue", function(buttonModule) {
        var methodReference = buttonModule.isReadyForContextPush.bind(buttonModule);

        buttonModule.isReadyForContextPush = function() {
            if (!this.allowAutoSubmit && !this.isPageLoadComplete()) {
                var context = this.getContext();
                // "series" is the value of the Pulldown's "name" param 
                var selectElement = context.get("series.element");
                if (selectElement.length>0);{
                    var numberOfOptions = selectElement[0].options.length;
                    return (numberOfOptions == 1);
                }
            }
            return methodReference();
        }
    });
}

3) And to artificially trigger the case when there's only one value in the Pulldown, change the Search upstream from the Pulldown so that it only ever matches one sourcetype, like so:

index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="splunkd" | dedup series | sort series | fields series

View solution in original post

SplunkTrust
SplunkTrust

Well, I don't think there's any way to do it without writing some custom Javascript.

If you're using Sideview Utils there are a couple things that make this particular solution a lot easier to put together, although you still need some custom JS.

To back up a second, Sideview Utils is an app, available as a free download if you accept the license, from the Sideview site -- ( http://sideviewapps.com/apps/sideview-utils ). The app packages a number of custom modules as well as several other useful tools. Those custom modules can be used in place of certain other core Splunk modules, and they offer simpler but at the same time more powerful ways to build your Splunk views and dashboards.

Then, even considering the greatly expanded possibilities of what you can do with no custom code at all, past that there is always a blue-sky envelope past which you need custom code.

This requirement of yours is actually one of that latter kind. Customizing this involves monkeying with when the module framework allows a "push" to proceed and as it happens this is a card that the Splunk module framework plays pretty close to the vest.

Anyway, I put together a quick packaged example showing exactly this, including the custom JS to run it. It uses just the index=_internal data so it should run fine on your instance.

1) Here is the XML.

<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <label>Button Example</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="HTML" layoutPanel="viewHeader">
    <param name="html"><![CDATA[
    <h1>Button - An example allowing automatic submission conditionally</h1>
    ]]></param>
  </module>

  <!-- EXAMPLE BEGIN -->
  <module name="Search" layoutPanel="panel_row2_col1" autoRun="True">
    <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="splunkd" | dedup series | sort series | fields series</param>
    <param name="earliest">-1h</param>
    <param name="latest">now</param>

    <module name="Pulldown">
      <param name="name">series</param>
      <param name="label">Sourcetype:</param>
      <param name="template">series="$value$"</param>
      <param name="valueField">series</param>
      <param name="staticOptions"></param>

      <module name="Button">
        <param name="allowAutoSubmit">False</param>
        <param name="allowSoftSubmit">True</param>
        <param name="customBehavior">autoSubmitWhenOnlyOneValue</param>

        <module name="Search">
          <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" $series$ | stats min(eps) avg(eps) max(eps) </param>
          <param name="earliest">-1h</param>
          <param name="latest">now</param>

          <module name="Pager">

            <module name="Table"></module>

          </module>
        </module>
      </module>
    </module>
  </module>
  <!-- EXAMPLE END -->

</view>

2) Here is the Javascript which you should put in your app's appserver/static/application.js file

NOTE: that the value of the Pulldown's "name" param is embedded in this JS so you'll have to change that if/when you adapt this example for your own use.

if (typeof(Sideview)!="undefined") {

    Sideview.utils.declareCustomBehavior("autoSubmitWhenOnlyOneValue", function(buttonModule) {
        var methodReference = buttonModule.isReadyForContextPush.bind(buttonModule);

        buttonModule.isReadyForContextPush = function() {
            if (!this.allowAutoSubmit && !this.isPageLoadComplete()) {
                var context = this.getContext();
                // "series" is the value of the Pulldown's "name" param 
                var selectElement = context.get("series.element");
                if (selectElement.length>0);{
                    var numberOfOptions = selectElement[0].options.length;
                    return (numberOfOptions == 1);
                }
            }
            return methodReference();
        }
    });
}

3) And to artificially trigger the case when there's only one value in the Pulldown, change the Search upstream from the Pulldown so that it only ever matches one sourcetype, like so:

index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="splunkd" | dedup series | sort series | fields series

View solution in original post

SplunkTrust
SplunkTrust

Cool. Well to do it without Utils would be trickier. For one thing you don't have the allowAutoSubmit behavior that the Button has, and for another thing you don't have the "foo.element" key that the Pulldown drops into the context. Both of these Sideview-isms are saving us some significant custom code here and giving us a headstart.

Thinking about it, the "easiest" way is probably to BOTH patch a NullModule, implementing isReadyForContextPush on it, AND patch SearchSelectLister. Both are advanced areas and tricky to patch, so you'll want to have a pretty deep understanding of both.

0 Karma

SplunkTrust
SplunkTrust

Marked As Accepted. I'll play with this when I have a little bit more time, but I was also trying to avoid having 3rd party dependencies for this particular app. But I love sideviews anyway 😄

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!