Dashboards & Visualizations

Cascading Dropdowns issue

oscargarcia
Path Finder

Hi,

I am having issues creating an advanced XML view with a pair of dropdowns that depend on each other. The data I am playing with is a single source that has a list of events such as:

djplatform1,djmonitor1
djplatform1,djmonitor2
djplatform1,djmonitor3
djplatform1,djmonitor4
djplatform1,djmonitor5
djplatform2,djmonitor6
djplatform2,djmonitor7
djplatform2,djmonitor8
djplatform2,djmonitor9
...

I want the form to have one dropdown with all the different djplatforms, and when selected, the second dropdown fills with the djmonitors that belong.

My code is the following:

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html">
  <label>Listers 1: intro</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>

  <module name="StaticContentSample" layoutPanel="panel_row1_col1">
    <param name="text">Alerts</param>
  </module>

  <module name="SearchSelectLister" layoutPanel="panel_row2_col1" group="Platforms">
    <param name="settingToCreate">series_setting</param>
    <param name="search">* | top djplatform</param>
    <param name="earliest">-90d@d</param>
    <param name="searchFieldsToDisplay">
        <list>
            <param name="value">djplatform</param>
            <param name="label">djplatform</param>
        </list>
    </param>
    <param name="label">Platform: </param>
    <module name="ConvertToIntention">
        <param name="settingToConvert">platform_setting</param>
        <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
                <param name="djplatform">
                    <param name="fillOnEmpty">True</param>
                    <param name="value">$target$</param>
                </param>
            </param>
        </param>

        <!--Set up DropDown with user list for specified host-->
        <module name="SearchSelectLister">
            <param name="settingToCreate">monitor_setting</param>
            <param name="applyOuterIntentionsToInternalSearch">True</param>
            <param name="searchWhenChanged">True</param>
            <param name="search">djplatform=$djplatform$ | top djmonitor limit 20</param>
            <param name="earliest">-90d@d</param>
            <param name="searchFieldsToDisplay">
                <list>
                    <param name="value">djmonitor</param>
                    <param name="label">djmonitor</param>
                </list>
            </param>
            <param name="label">Monitor:</param>
            <module name="ConvertToIntention">
                <param name="settingToConvert">monitor_setting</param>
                <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                        <param name="djmonitor">
                            <param name="fillOnEmpty">True</param>
                            <param name="value">$target$</param>
                        </param>
                    </param>
                </param>
            </module>

            <module name="SubmitButton">
              <param name="label">Search</param>
              <module name="ViewRedirector">
                <param name="popup">True</param>
                <param name="viewTarget">really_simple_viewer</param>
              </module>
            </module>

       </module> 
    </module>
</module>


</view>

And when I go and see the view, the first dropdown works well, but the second does not, and I am getting these errors:

Error in 'search' command: Unable to parse the search: Comparison is missing a term on the right hand side.

and

This SearchLister module could not retrieve its results. A 500 error was returned with the following text "Internal Server Error".

Any help would be much appreciated

Oscar

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

The problem is that your first pulldown creates a context key called 'series_setting', but the ConvertToIntention is converting from a key called 'platform_setting', which doesnt exist.

Particularly since you're using multiple dynamic pulldowns and a redirect to a custom view, You may want to look at sideview_utils, because it provides alternate modules that make things like this much easier.

For instance here's the same functionality basically but it becomes a lot simpler and there are no intentions to deal with. Also both Pulldown modules can be fed by the same search which makes it finish rendering a lot faster, and changing the first Pulldown changes the second instantaneously.

<module name="Search">
  <param name="search">* | stats count by djplatform, djmonitor</param>

  <module name="Pulldown">
    <param name="name">djplatform</param>
    <param name="label">Platform</param>
    <param name="template">$name$="$value$"</param>
    <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>

    <module name="Pulldown">
      <param name="name">djmonitor</param>
      <param name="label">Monitor</param>
      <param name="template">$name$="$value$"</param>
      <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
      <param name="searchFieldsToDisplay">
        <list>
          <param name="value">$name$</param>
        </list>
      </param>

      <module name="Search">
        <param name="search">$djplatform$ $djmonitor$</param>

        <module name="Pager">
          <param name="entityName">results</param>
          <module name="SimpleResultsTable">
            <param name="displayRowNumbers">False</param>
            <param name="entityName">results</param>
          </module>
        </module>
      </module>
    </module>

  </module>
</module>

View solution in original post

sideview
SplunkTrust
SplunkTrust

The problem is that your first pulldown creates a context key called 'series_setting', but the ConvertToIntention is converting from a key called 'platform_setting', which doesnt exist.

Particularly since you're using multiple dynamic pulldowns and a redirect to a custom view, You may want to look at sideview_utils, because it provides alternate modules that make things like this much easier.

For instance here's the same functionality basically but it becomes a lot simpler and there are no intentions to deal with. Also both Pulldown modules can be fed by the same search which makes it finish rendering a lot faster, and changing the first Pulldown changes the second instantaneously.

<module name="Search">
  <param name="search">* | stats count by djplatform, djmonitor</param>

  <module name="Pulldown">
    <param name="name">djplatform</param>
    <param name="label">Platform</param>
    <param name="template">$name$="$value$"</param>
    <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>

    <module name="Pulldown">
      <param name="name">djmonitor</param>
      <param name="label">Monitor</param>
      <param name="template">$name$="$value$"</param>
      <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
      <param name="searchFieldsToDisplay">
        <list>
          <param name="value">$name$</param>
        </list>
      </param>

      <module name="Search">
        <param name="search">$djplatform$ $djmonitor$</param>

        <module name="Pager">
          <param name="entityName">results</param>
          <module name="SimpleResultsTable">
            <param name="displayRowNumbers">False</param>
            <param name="entityName">results</param>
          </module>
        </module>
      </module>
    </module>

  </module>
</module>

oscargarcia
Path Finder

Thanks for the pointer. It works great.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...