Dashboards & Visualizations

Chart state-preservation

SalvadorFlores
Explorer

Hello,

I'm using Splunk 4.3.4 and I've been searching for some way to turn off the state-preservation mentioned in the link below:

http://splunk-base.splunk.com/answers/55770/bar-chart-minimum-height

The idea is to set the chart's height as static, so even after users rezise it next time they access the dashboard it will go back to the same height for charts.

Thank you!

1 Solution

sideview
SplunkTrust
SplunkTrust

It's basically controlled by the isSticky attribute on the view tag.

However, and this is the unfortunate part, setting isSticky to False will just tell splunk that you no longer wish to keep track of changes made by each user. It won't actually discard the last-previously-stuck values for each user. So if the last edit a given user made before you set isSticky to false was to make the chart 5px high, for them the chart will then remain 5px high for eternity.

So, all these 'sticky' settings are remembered separately for each of your users, and each will have little viewstate stanzas scattered in /etc/users/<username>/viewstates.conf

Unfortunately short of changing the name of the view and thus the URL, you'll have to go find all the old viewstates and delete them.

View solution in original post

sideview
SplunkTrust
SplunkTrust

It's basically controlled by the isSticky attribute on the view tag.

However, and this is the unfortunate part, setting isSticky to False will just tell splunk that you no longer wish to keep track of changes made by each user. It won't actually discard the last-previously-stuck values for each user. So if the last edit a given user made before you set isSticky to false was to make the chart 5px high, for them the chart will then remain 5px high for eternity.

So, all these 'sticky' settings are remembered separately for each of your users, and each will have little viewstate stanzas scattered in /etc/users/<username>/viewstates.conf

Unfortunately short of changing the name of the view and thus the URL, you'll have to go find all the old viewstates and delete them.

SalvadorFlores
Explorer

This solved the problem, thank you very much!

0 Karma

sideview
SplunkTrust
SplunkTrust

That's right. I think "True" is the default so if you don't have an isSticky attribute in the view tag than it'll be the same as having isSticky="True". Put an isSticky="False" and Splunk will stop remembering changes going forward. But remember that means that each user will be stuck with whatever their last-remembered value was.

0 Karma

SalvadorFlores
Explorer

Thank you for the quick reply.

I've been looking at the advanced XML and some other posts but I can't seem to find isSticky or isPersistable in the view tag nor the whole XML. My view tag only has

autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html"

Shall I just add the isSticky there?
I don't have access to the viewstates.conf but is useful info though.

Thank you.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...