Dashboards & Visualizations

Cascading Dropdowns issue

oscargarcia
Path Finder

Hi,

I am having issues creating an advanced XML view with a pair of dropdowns that depend on each other. The data I am playing with is a single source that has a list of events such as:

djplatform1,djmonitor1
djplatform1,djmonitor2
djplatform1,djmonitor3
djplatform1,djmonitor4
djplatform1,djmonitor5
djplatform2,djmonitor6
djplatform2,djmonitor7
djplatform2,djmonitor8
djplatform2,djmonitor9
...

I want the form to have one dropdown with all the different djplatforms, and when selected, the second dropdown fills with the djmonitors that belong.

My code is the following:

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html">
  <label>Listers 1: intro</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>

  <module name="StaticContentSample" layoutPanel="panel_row1_col1">
    <param name="text">Alerts</param>
  </module>

  <module name="SearchSelectLister" layoutPanel="panel_row2_col1" group="Platforms">
    <param name="settingToCreate">series_setting</param>
    <param name="search">* | top djplatform</param>
    <param name="earliest">-90d@d</param>
    <param name="searchFieldsToDisplay">
        <list>
            <param name="value">djplatform</param>
            <param name="label">djplatform</param>
        </list>
    </param>
    <param name="label">Platform: </param>
    <module name="ConvertToIntention">
        <param name="settingToConvert">platform_setting</param>
        <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
                <param name="djplatform">
                    <param name="fillOnEmpty">True</param>
                    <param name="value">$target$</param>
                </param>
            </param>
        </param>

        <!--Set up DropDown with user list for specified host-->
        <module name="SearchSelectLister">
            <param name="settingToCreate">monitor_setting</param>
            <param name="applyOuterIntentionsToInternalSearch">True</param>
            <param name="searchWhenChanged">True</param>
            <param name="search">djplatform=$djplatform$ | top djmonitor limit 20</param>
            <param name="earliest">-90d@d</param>
            <param name="searchFieldsToDisplay">
                <list>
                    <param name="value">djmonitor</param>
                    <param name="label">djmonitor</param>
                </list>
            </param>
            <param name="label">Monitor:</param>
            <module name="ConvertToIntention">
                <param name="settingToConvert">monitor_setting</param>
                <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                        <param name="djmonitor">
                            <param name="fillOnEmpty">True</param>
                            <param name="value">$target$</param>
                        </param>
                    </param>
                </param>
            </module>

            <module name="SubmitButton">
              <param name="label">Search</param>
              <module name="ViewRedirector">
                <param name="popup">True</param>
                <param name="viewTarget">really_simple_viewer</param>
              </module>
            </module>

       </module> 
    </module>
</module>


</view>

And when I go and see the view, the first dropdown works well, but the second does not, and I am getting these errors:

Error in 'search' command: Unable to parse the search: Comparison is missing a term on the right hand side.

and

This SearchLister module could not retrieve its results. A 500 error was returned with the following text "Internal Server Error".

Any help would be much appreciated

Oscar

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

The problem is that your first pulldown creates a context key called 'series_setting', but the ConvertToIntention is converting from a key called 'platform_setting', which doesnt exist.

Particularly since you're using multiple dynamic pulldowns and a redirect to a custom view, You may want to look at sideview_utils, because it provides alternate modules that make things like this much easier.

For instance here's the same functionality basically but it becomes a lot simpler and there are no intentions to deal with. Also both Pulldown modules can be fed by the same search which makes it finish rendering a lot faster, and changing the first Pulldown changes the second instantaneously.

<module name="Search">
  <param name="search">* | stats count by djplatform, djmonitor</param>

  <module name="Pulldown">
    <param name="name">djplatform</param>
    <param name="label">Platform</param>
    <param name="template">$name$="$value$"</param>
    <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>

    <module name="Pulldown">
      <param name="name">djmonitor</param>
      <param name="label">Monitor</param>
      <param name="template">$name$="$value$"</param>
      <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
      <param name="searchFieldsToDisplay">
        <list>
          <param name="value">$name$</param>
        </list>
      </param>

      <module name="Search">
        <param name="search">$djplatform$ $djmonitor$</param>

        <module name="Pager">
          <param name="entityName">results</param>
          <module name="SimpleResultsTable">
            <param name="displayRowNumbers">False</param>
            <param name="entityName">results</param>
          </module>
        </module>
      </module>
    </module>

  </module>
</module>

View solution in original post

sideview
SplunkTrust
SplunkTrust

The problem is that your first pulldown creates a context key called 'series_setting', but the ConvertToIntention is converting from a key called 'platform_setting', which doesnt exist.

Particularly since you're using multiple dynamic pulldowns and a redirect to a custom view, You may want to look at sideview_utils, because it provides alternate modules that make things like this much easier.

For instance here's the same functionality basically but it becomes a lot simpler and there are no intentions to deal with. Also both Pulldown modules can be fed by the same search which makes it finish rendering a lot faster, and changing the first Pulldown changes the second instantaneously.

<module name="Search">
  <param name="search">* | stats count by djplatform, djmonitor</param>

  <module name="Pulldown">
    <param name="name">djplatform</param>
    <param name="label">Platform</param>
    <param name="template">$name$="$value$"</param>
    <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">$name$</param>
      </list>
    </param>

    <module name="Pulldown">
      <param name="name">djmonitor</param>
      <param name="label">Monitor</param>
      <param name="template">$name$="$value$"</param>
      <param name="postProcess">fields $name$ | dedup $name$ | sort $name$</param>
      <param name="searchFieldsToDisplay">
        <list>
          <param name="value">$name$</param>
        </list>
      </param>

      <module name="Search">
        <param name="search">$djplatform$ $djmonitor$</param>

        <module name="Pager">
          <param name="entityName">results</param>
          <module name="SimpleResultsTable">
            <param name="displayRowNumbers">False</param>
            <param name="entityName">results</param>
          </module>
        </module>
      </module>
    </module>

  </module>
</module>

oscargarcia
Path Finder

Thanks for the pointer. It works great.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...