Dashboards & Visualizations

Cascading Dropdowns issue

oscargarcia
Path Finder

Hi,

I am having issues creating an advanced XML view with a pair of dropdowns that depend on each other. The data I am playing with is a single source that has a list of events such as:

djplatform1,djmonitor1
djplatform1,djmonitor2
djplatform1,djmonitor3
djplatform1,djmonitor4
djplatform1,djmonitor5
djplatform2,djmonitor6
djplatform2,djmonitor7
djplatform2,djmonitor8
djplatform2,djmonitor9
...

I want the form to have one dropdown with all the different djplatforms, and when selected, the second dropdown fills with the djmonitors that belong.

My code is the following:

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html">
  <label>Listers 1: intro</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>

  <module name="StaticContentSample" layoutPanel="panel_row1_col1">
    <param name="text">Alerts</param>
  </module>

  <module name="SearchSelectLister" layoutPanel="panel_row2_col1" group="Platforms">
    <param name="settingToCreate">series_setting</param>
    <param name="search">* | top djplatform</param>
    <param name="earliest">-90d@d</param>
    <param name="searchFieldsToDisplay">
        <list>
            <param name="value">djplatform</param>
            <param name="label">djplatform</param>
        </list>
    </param>
    <param name="label">Platform: </param>
    <module name="ConvertToIntention">
        <param name="settingToConvert">platform_setting</param>
        <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
                <param name="djplatform">
                    <param name="fillOnEmpty">True</param>
                    <param name="value">$target$</param>
                </param>
            </param>
        </param>

        <!--Set up DropDown with user list for specified host-->
        <module name="SearchSelectLister">
            <param name="settingToCreate">monitor_setting</param>
            <param name="applyOuterIntentionsToInternalSearch">True</param>
            <param name="searchWhenChanged">True</param>
            <param name="search">djplatform=$djplatform$ | top djmonitor limit 20</param>
            <param name="earliest">-90d@d</param>
            <param name="searchFieldsToDisplay">
                <list>
                    <param name="value">djmonitor</param>
                    <param name="label">djmonitor</param>
                </list>
            </param>
            <param name="label">Monitor:</param>
            <module name="ConvertToIntention">
                <param name="settingToConvert">monitor_setting</param>
                <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                        <param name="djmonitor">
                            <param name="fillOnEmpty">True</param>
                            <param name="value">$target$</param>
                        </param>
                    </param>
                </param>
            </module>

            <module name="SubmitButton">
              <param name="label">Search</param>
              <module name="ViewRedirector">
                <param name="popup">True</param>
                <param name="viewTarget">really_simple_viewer</param>
              </module>
            </module>

       </module> 
    </module>
</module>


</view>

And when I go and see the view, the first dropdown works well, but the second does not, and I am getting these errors:

Error in 'search' command: Unable to parse the search: Comparison is missing a term on the right hand side.

and

This SearchLister module could not retrieve its results. A 500 error was returned with the following text "Internal Server Error".

Any help would be much appreciated

Oscar

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

The problem is that your first pulldown creates a context key called 'series_setting', but the ConvertToIntention is converting from a key called 'platform_setting', which doesnt exist.

Particularly since you're using multiple dynamic pulldowns and a redirect to a custom view, You may want to look at sideview_utils, because it provides alternate modules that make things like this much easier.

For instance here's the same functionality basically but it becomes a lot simpler and there are no intentions to deal with. Also both Pulldown modules can be fed by the same search which makes it finish rendering a lot faster, and changing the first Pulldown changes the second instantaneously.

<module name="Search">
  <param name="search">* | stats count by djplatform, djmonitor</param>

  <module name="Pulldown">
    <param name="name">djplatform</param>
    <param name="label">Platform</param>
    <param name="template">$name$="$value$"</param>
    <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>

    <module name="Pulldown">
      <param name="name">djmonitor</param>
      <param name="label">Monitor</param>
      <param name="template">$name$="$value$"</param>
      <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
      <param name="searchFieldsToDisplay">
        <list>
          <param name="value">$name$</param>
        </list>
      </param>

      <module name="Search">
        <param name="search">$djplatform$ $djmonitor$</param>

        <module name="Pager">
          <param name="entityName">results</param>
          <module name="SimpleResultsTable">
            <param name="displayRowNumbers">False</param>
            <param name="entityName">results</param>
          </module>
        </module>
      </module>
    </module>

  </module>
</module>

View solution in original post

sideview
SplunkTrust
SplunkTrust

The problem is that your first pulldown creates a context key called 'series_setting', but the ConvertToIntention is converting from a key called 'platform_setting', which doesnt exist.

Particularly since you're using multiple dynamic pulldowns and a redirect to a custom view, You may want to look at sideview_utils, because it provides alternate modules that make things like this much easier.

For instance here's the same functionality basically but it becomes a lot simpler and there are no intentions to deal with. Also both Pulldown modules can be fed by the same search which makes it finish rendering a lot faster, and changing the first Pulldown changes the second instantaneously.

<module name="Search">
  <param name="search">* | stats count by djplatform, djmonitor</param>

  <module name="Pulldown">
    <param name="name">djplatform</param>
    <param name="label">Platform</param>
    <param name="template">$name$="$value$"</param>
    <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>

    <module name="Pulldown">
      <param name="name">djmonitor</param>
      <param name="label">Monitor</param>
      <param name="template">$name$="$value$"</param>
      <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
      <param name="searchFieldsToDisplay">
        <list>
          <param name="value">$name$</param>
        </list>
      </param>

      <module name="Search">
        <param name="search">$djplatform$ $djmonitor$</param>

        <module name="Pager">
          <param name="entityName">results</param>
          <module name="SimpleResultsTable">
            <param name="displayRowNumbers">False</param>
            <param name="entityName">results</param>
          </module>
        </module>
      </module>
    </module>

  </module>
</module>

oscargarcia
Path Finder

Thanks for the pointer. It works great.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...