Chart Data Preview

[Ant1D]

Hi,

I was just asked if there was an option to disable the results preview for a chart for which I replied "Yes, there is". We just want to see the final chart with the full results instead of watching the chart build the results in stages as it loads.

So...using Simple XML I added the charting.data.preview property to the end of the attributes that sit within chart tags but it did not disable the results preview:

   <option name="charting.chart">column</option>
  <option name="charting.axisTitleX.text">Time</option>
  <option name="charting.axisTitleX.visibility">visible</option>
  <option name="charting.axisTitleY.text">Count</option>
  <option name="charting.axisTitleY.visibility">visible</option>
  <option name="charting.chart.nullValueMode">gaps</option>
  <option name="charting.chart.stackMode">stacked</option>
  <option name="charting.chart.style">shiny</option>
  <option name="charting.drilldown">all</option>
  <option name="charting.layout.splitSeries">0</option>
  <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  <option name="charting.legend.placement">right</option>
  <option name="charting.axisX.scale">linear</option>
  <option name="charting.axisY.scale">linear</option>
  <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  <option name="charting.data.preview">false</option> 

Note: Some of the options were added to the XML by default when making chart changes using the Splunk UI. I am using Splunk v6.0.1.
My understanding according to the Chart Config Reference is that chart data preview is set to false by default so it should not be necessary for me to set the above option for it to work.
Any ideas why my chart continues to preview results? Could one of the other chart properties be the cause? Thanks in advance for your help.

[martin_mueller]

This may not be achievable though SimpleXML configuration alone, or at least I don't know of a way.

However, you can disable the preview in regular searching (Statistics Tab -> No Preview) and save that search as a Report - the "No Preview" setting will persist. Similarly, using that Report on a Dashboard will honor that setting and not display a preview.

[martin_mueller]

You can always move to SplunkJS / the Web Framework where searches run by a SearchManager do have such a flag:

preview: Indicates if preview is enabled for this search job. By default, preview is enabled for realtime searches and for searches where status_buckets > 0. Set to false to disable preview.

http://docs.splunk.com/Documentation/WebFramework

That's used by SimpleXML underneath so it's all there, it just might not be passed down (yet?).

[Ant1D]

Thanks Martin. I will give this a try and update this thread once I have. While it is not ideal, it is a workaround of sorts which is better than nothing 🙂 Not convinced I will be able to use this in a form with token inputs.

In Advanced XML it's easy to do via the EnablePreview module.

It would be interesting to know if anyone has had some trouble with this and what they did to fix that.