Dashboards & Visualizations

Cascading Dropdowns issue

oscargarcia
Path Finder

Hi,

I am having issues creating an advanced XML view with a pair of dropdowns that depend on each other. The data I am playing with is a single source that has a list of events such as:

djplatform1,djmonitor1
djplatform1,djmonitor2
djplatform1,djmonitor3
djplatform1,djmonitor4
djplatform1,djmonitor5
djplatform2,djmonitor6
djplatform2,djmonitor7
djplatform2,djmonitor8
djplatform2,djmonitor9
...

I want the form to have one dropdown with all the different djplatforms, and when selected, the second dropdown fills with the djmonitors that belong.

My code is the following:

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html">
  <label>Listers 1: intro</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>

  <module name="StaticContentSample" layoutPanel="panel_row1_col1">
    <param name="text">Alerts</param>
  </module>

  <module name="SearchSelectLister" layoutPanel="panel_row2_col1" group="Platforms">
    <param name="settingToCreate">series_setting</param>
    <param name="search">* | top djplatform</param>
    <param name="earliest">-90d@d</param>
    <param name="searchFieldsToDisplay">
        <list>
            <param name="value">djplatform</param>
            <param name="label">djplatform</param>
        </list>
    </param>
    <param name="label">Platform: </param>
    <module name="ConvertToIntention">
        <param name="settingToConvert">platform_setting</param>
        <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
                <param name="djplatform">
                    <param name="fillOnEmpty">True</param>
                    <param name="value">$target$</param>
                </param>
            </param>
        </param>

        <!--Set up DropDown with user list for specified host-->
        <module name="SearchSelectLister">
            <param name="settingToCreate">monitor_setting</param>
            <param name="applyOuterIntentionsToInternalSearch">True</param>
            <param name="searchWhenChanged">True</param>
            <param name="search">djplatform=$djplatform$ | top djmonitor limit 20</param>
            <param name="earliest">-90d@d</param>
            <param name="searchFieldsToDisplay">
                <list>
                    <param name="value">djmonitor</param>
                    <param name="label">djmonitor</param>
                </list>
            </param>
            <param name="label">Monitor:</param>
            <module name="ConvertToIntention">
                <param name="settingToConvert">monitor_setting</param>
                <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                        <param name="djmonitor">
                            <param name="fillOnEmpty">True</param>
                            <param name="value">$target$</param>
                        </param>
                    </param>
                </param>
            </module>

            <module name="SubmitButton">
              <param name="label">Search</param>
              <module name="ViewRedirector">
                <param name="popup">True</param>
                <param name="viewTarget">really_simple_viewer</param>
              </module>
            </module>

       </module> 
    </module>
</module>


</view>

And when I go and see the view, the first dropdown works well, but the second does not, and I am getting these errors:

Error in 'search' command: Unable to parse the search: Comparison is missing a term on the right hand side.

and

This SearchLister module could not retrieve its results. A 500 error was returned with the following text "Internal Server Error".

Any help would be much appreciated

Oscar

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

The problem is that your first pulldown creates a context key called 'series_setting', but the ConvertToIntention is converting from a key called 'platform_setting', which doesnt exist.

Particularly since you're using multiple dynamic pulldowns and a redirect to a custom view, You may want to look at sideview_utils, because it provides alternate modules that make things like this much easier.

For instance here's the same functionality basically but it becomes a lot simpler and there are no intentions to deal with. Also both Pulldown modules can be fed by the same search which makes it finish rendering a lot faster, and changing the first Pulldown changes the second instantaneously.

<module name="Search">
  <param name="search">* | stats count by djplatform, djmonitor</param>

  <module name="Pulldown">
    <param name="name">djplatform</param>
    <param name="label">Platform</param>
    <param name="template">$name$="$value$"</param>
    <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>

    <module name="Pulldown">
      <param name="name">djmonitor</param>
      <param name="label">Monitor</param>
      <param name="template">$name$="$value$"</param>
      <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
      <param name="searchFieldsToDisplay">
        <list>
          <param name="value">$name$</param>
        </list>
      </param>

      <module name="Search">
        <param name="search">$djplatform$ $djmonitor$</param>

        <module name="Pager">
          <param name="entityName">results</param>
          <module name="SimpleResultsTable">
            <param name="displayRowNumbers">False</param>
            <param name="entityName">results</param>
          </module>
        </module>
      </module>
    </module>

  </module>
</module>

View solution in original post

sideview
SplunkTrust
SplunkTrust

The problem is that your first pulldown creates a context key called 'series_setting', but the ConvertToIntention is converting from a key called 'platform_setting', which doesnt exist.

Particularly since you're using multiple dynamic pulldowns and a redirect to a custom view, You may want to look at sideview_utils, because it provides alternate modules that make things like this much easier.

For instance here's the same functionality basically but it becomes a lot simpler and there are no intentions to deal with. Also both Pulldown modules can be fed by the same search which makes it finish rendering a lot faster, and changing the first Pulldown changes the second instantaneously.

<module name="Search">
  <param name="search">* | stats count by djplatform, djmonitor</param>

  <module name="Pulldown">
    <param name="name">djplatform</param>
    <param name="label">Platform</param>
    <param name="template">$name$="$value$"</param>
    <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>

    <module name="Pulldown">
      <param name="name">djmonitor</param>
      <param name="label">Monitor</param>
      <param name="template">$name$="$value$"</param>
      <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
      <param name="searchFieldsToDisplay">
        <list>
          <param name="value">$name$</param>
        </list>
      </param>

      <module name="Search">
        <param name="search">$djplatform$ $djmonitor$</param>

        <module name="Pager">
          <param name="entityName">results</param>
          <module name="SimpleResultsTable">
            <param name="displayRowNumbers">False</param>
            <param name="entityName">results</param>
          </module>
        </module>
      </module>
    </module>

  </module>
</module>

oscargarcia
Path Finder

Thanks for the pointer. It works great.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...