Dashboards & Visualizations

Displaying results table in tab switcher tab, BEFORE clicking on drilldown field in panel above

tgeer123
Path Finder

I have a dashboard with two panels. The first panel contains a table which is a drilldown table. When the value is clicked, the second panel has three tabs with different searches, for the filtered by the clicked item. The drilldown and intention, etc all work fine. The problem is before you click, the second panel is hidden, or blank. The customer would like there to be a default search results shown (as if it were clicked!)
I unfortunately cannot use sideview utils and all its wonderfulness 😞

12/23/2013 UPDATED XML:

<view autoCancelInterval="90" isVisible="True" objectMode="SimpleDashboard" onunloadCancelJobs="True" refresh="60" template="dashboard.html" stylesheet="remotemon.css">
<script type="text/javascript" src="/static/app/SystemMonitor/application.js"></script>
<label>Status of Remote Libraries</label>
<module name="AccountBar" layoutPanel="appHeader" />
<module name="AppBar" layoutPanel="navigationHeader" />
<module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">false</param>
    <param name="maxSize">1</param>
</module>
<module name="StaticContentSample" layoutPanel="panel_row2_col1">
    <param name="text">Remote Library Monitor Summary</param>
</module>
<module name="StaticContentSample" layoutPanel="panel_row2_col1_grp2">
    <param name="text">Subsystems</param>
</module>
<module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp2" group=" " autoRun="True">
    <param name="savedSearch">remote_level1_subsys</param>
    <module name="ModifiedSimpleResultsTable">
        <param name="showResetButton">false</param>
        <param name="isSortEnabled">false</param>
        <param name="displayRowNumbers">false</param>
        <module name="EnablePreview">
            <param name="enable">True</param>
            <param name="display">false</param>
        </module>
    </module>
    <module name="StaticContentSample" layoutPanel="panel_row2_col1_grp3">
        <param name="text">Functional</param>
    </module>
    <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp3" group=" ">
        <param name="savedSearch">remote_level1_functional</param>
        <module name="ModifiedSimpleResultsTable">
            <param name="showResetButton">false</param>
            <param name="isSortEnabled">false</param>
            <param name="displayRowNumbers">false</param>
            <module name="EnablePreview">
                <param name="enable">True</param>
                <param name="display">false</param>
            </module>
        </module>
        <module name="StaticContentSample" layoutPanel="panel_row2_col1_grp4">
            <param name="text">BIT</param>
        </module>
        <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp4" group=" ">
            <param name="savedSearch">remote_level1_bit</param>
            <module name="ModifiedSimpleResultsTable">
                <param name="showResetButton">false</param>
                <param name="isSortEnabled">false</param>
                <param name="displayRowNumbers">false</param>
                <module name="EnablePreview">
                    <param name="enable">True</param>
                    <param name="display">false</param>
                </module>
            </module>
            <!--  End HiddenSavedSearch  -->
        </module>
        <!--  End HiddenSavedSearch  -->
    </module>
    <!--  End HiddenSavedSearch  -->
</module>
<!--  End HiddenSavedSearch  -->
<module name="StaticContentSample" layoutPanel="panel_row2_col1_grp1">
    <param name="text">Library</param>
</module>
<module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp1" group=" " autoRun="True">
  <param name="savedSearch">remote_level1_lib</param>
    <module name="ModifiedSimpleResultsTable">
        <param name="showResetButton">false</param>
        <param name="isSortEnabled">false</param>
        <param name="drilldown">all</param>
        <param name="displayRowNumbers">false</param>
        <module name="EnablePreview">
            <param name="enable">True</param>
            <param name="display">false</param>
            <module name="ConvertToIntention">
                <param name="settingToConvert">libname_setting</param>
                <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                        <param name="libname">
                            <param name="value">$target$</param>
                        </param>
                    </param>
                </param>
                <module name="TabSwitcher" layoutPanel="panel_row4_col1">
                    <param name="mode">independent</param>
                    <param name="selected">Subsystems</param>
                    <!-- First switcher -->
                    <module name="HiddenSearch" layoutPanel="panel_row4_col1_grp1" group="Subsystem2">
                        <param name="search">
              sourcetype="remotemon_subsys" 
              | stats first(Errors) AS latesterrors, first(Cores) AS latestcores, first(LastErrorTime) AS lerrortime, first(subreset) AS lreset by libname, subsystemname
              | convert ctime(lreset)
              | table libname, subsystemname, latesterrors, latestcores, lerrortime, lreset
              | rename subsystemname AS "Subsystem Name" lerrortime AS "Last Error Time", latesterrors AS Errors, latestcores AS Cores, lreset AS "Last Reset"
              | fillnull Errors, Cores
            </param>
                        <module name="Paginator">
                            <param name="count">25</param>
                            <param name="entityName">results</param>
                            <param name="maxPages">10</param>
                            <module name="HiddenFieldPicker">
                                <param name="strictMode">True</param>
                                <module name="ModifiedSimpleResultsTable" layoutPanel="panel_row4_col1">
                                    <param name="showResetButton">false</param>
                                    <param name="allowTransformedFieldSelect">True</param>
                                </module>
                            </module>
                        </module>
                    </module>
                    <!-- Second switcher -->
                    <module name="HiddenSearch" layoutPanel="panel_row4_col1_grp2" group="Functional2" autoRun="True">
                        <param name="search">
    sourcetype="remotemon_func" 
            | stats first(fivemin) AS l5min, first(thirtymin) AS l30min, first(hour) AS lhour, first(twentyfourhr) AS l24hr, first(failed) AS lFail first(catreset) AS lcatreset by libname, function
            | convert ctime(lcatreset)
            | table libname, function, l5min, l30min, lhour, l24hr, lFail, lcatreset
            | rename libname AS "Library Name" function AS "ASP Function", l5min AS "5 Mins", l30min AS "30 mins", lhour AS "1 Hour", l24hr AS "24 hours", lFail AS "Failed", lcatreset AS "Last Reset"
            | fillnull "5 Mins", "30 mins", "1 Hour", "24 hours", "Failed" 
            </param>
                        <module name="Paginator">
                            <param name="count">25</param>
                            <param name="entityName">results</param>
                            <param name="maxPages">10</param>
                            <module name="HiddenFieldPicker">
                                <param name="strictMode">True</param>
                                <module name="ModifiedSimpleResultsTable" layoutPanel="panel_row4_col1">
                                    <param name="showResetButton">false</param>
                                    <param name="allowTransformedFieldSelect">True</param>
                                </module>
                            </module>
                        </module>
                    </module>
                    <!--  Third switcher -->
                    <module name="HiddenSearch" layoutPanel="panel_row4_col1_grp3" group="BIT2" autoRun="True">
                        <param name="search">
              sourcetype="remotemon_bit" 
              | stats first(errors) AS lbiterrors, first(runs) AS lruns, first(BITReset) AS lBITReset by libname, bit
              | convert ctime(lBITReset)
              | table libname, bit, lruns, lbiterrors, lBITReset
              | rename libname AS "Library Name", bit AS "BIT Name" lruns AS "Runs", lbiterrors AS "Failed", lBITReset AS "Last Reset"
              | fillnull "Runs", "Failed" 
            </param>
                        <module name="Paginator">
                            <param name="count">25</param>
                            <param name="entityName">results</param>
                            <param name="maxPages">10</param>
                            <module name="HiddenFieldPicker">
                                <param name="strictMode">True</param>
                                <module name="ModifiedSimpleResultsTable" layoutPanel="panel_row4_col1">
                                    <param name="showResetButton">false</param>
                                    <param name="allowTransformedFieldSelect">True</param>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>
            </module>
        </module>
    </module>
</module>

sideview
SplunkTrust
SplunkTrust

I don't think there's a way to do this without Sideview Utils. If you do have Sideview Utils though, this is exactly what the "default" param on the Table module does - it allows there to be an initially selected selection on a drilldown table.

Prior to the existence of the Table module, I used to patch the SimpleResultsTable module's behavior to do this sort of thing. This kind of patch involves understanding isReadyForContextPush, which is one of the least documented areas of the framework, but the code at least for such a patch is relatively short. Note here the "some_special_view" to make sure that the patch only applies within a particular view.

if (Splunk.Module.SimpleResultsTable && Splunk.util.getCurrentView() == "some_special_view") {
    Splunk.Module.SimpleResultsTable = $.klass(Splunk.Module.SimpleResultsTable, {
        hideDescendants: function() {},
        showDescendants: function() {},
        isReadyForContextPush:function() {
            if (this.getLoadState() < Splunk.util.moduleLoadStates.HAS_CONTEXT) return false;
            return true;
        }
    });
}

But it's definitely better to just use the Table module if you can.

0 Karma

sideview
SplunkTrust
SplunkTrust

hehe. Well good. Since some of the elements in the upper panel are upstream from the elements in the downstream panel, the push triggered by the first autorefresh basically will cascade to the second one unless you somehow stop it. In core modules there's no way to stop it. In Sideview Utils it's an advanced topic but there are a couple tools.

0 Karma

tgeer123
Path Finder

I actually got this to work! I used a custom autorefresh module we have, split my summary table used for the intention, and added the autorefresh module to all the tables, but not the converttointention piece. Now a new issue...the autorefresh triggers off refreshes of the upper and lower panel as planned. Then the lower panel refreshes again within a couple of seconds. There is only two instances of the module in my XML and the closing tags are correctly placed so each run independently... if I remove the second instance of it, those searches don't refresh.

0 Karma

sideview
SplunkTrust
SplunkTrust

Oh I see. libname_setting was wrong - copied from earlier intention example. But that's fine - just use $click.value$ in the intention itself and have no "settingToConvert" param at all. That's the other way to do it.

As far as it filling null values and spooky intention behavior and not wiping the table selection when the page is reloaded.... no if you can only use the core stuff you're kinda at the end of the rope here.

0 Karma

tgeer123
Path Finder

yeah ...so that didn't exactly work. For some reason, first of all I have to use $click.value$, not $target$. And second, because of the way the data is gotten and used, it "fills" the null even on ones where I have a libname, just no records. I'm ok with having the bottom be "empty" until clicked..the new issue is that they want the page to auto refresh every 60 seconds....when that happens-- everything goes back to as it was...is there a way to have the intentions persist?

0 Karma

sideview
SplunkTrust
SplunkTrust

Here it is. It's hideous.

<module name="ConvertToIntention">
  <param name="settingToConvert">libname_setting</param>
  <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
          <param name="libname">
              <param name="default"> </param>
              <param name="fillOnEmpty">true</param>
              <param name="value">$target$</param>
          </param>
      </param>
  </param>
0 Karma

sideview
SplunkTrust
SplunkTrust

Phew. Glad you made it. This has been painful to watch and I worry that by helping you I've done you a disservice. It would be better to just go get powers that be to buy oem license to utils. You probably realize you've done in weeks what really takes minutes with sideview utils.
As for the last remaining issue, stringreplace intention itself has a defaulting mechanism but like all things in core advanced xml it's very complicated and basically undocumented. I'll post new xml for you and thus enable you to do things the crazy way one last time. =/

0 Karma

tgeer123
Path Finder

YAY!!!! FINALLY got this working...I have one small issue to resolve - which is similar to what started this whole thing 🙂 Since the search is actually setting the libname from the intention - before you click - libname=$libname$ turns out to be libname=NULL, need to set it to default from a lookup. Anyways- my issue with the intention was fixed by adding the additional search as suggested but I also had an issue with the field value containing a dash-- had to enclose with quotes - libname="$libname$"
THANKS SO MUCH FOR ALL YOUR HELP NICK! (aka sideview) 🙂

0 Karma

tgeer123
Path Finder

updated xml on original post

0 Karma

sideview
SplunkTrust
SplunkTrust

you should post updated XML, because you've been making changes since the last XML you posted and I'm afraid its getting a little foggy. And leave the search language in there, even if you have to anonymize or simplify it, rather than replacing it with "my search here" etc..

But basically when you switched from an addterm intention to a stringreplace intention, now for that intention to function at all, there has to be a "$libname$" somewhere in the search string, whether that search is coming from HiddenSearch or from HiddenSavedSearch. With no $libname$, the intention will do nothing.

0 Karma

tgeer123
Path Finder

All the examples I see are using listers..which I am not so maybe thats my confusion, but I am not sure I follow. You are saying to add a new hidden search that is the same as the remote_level1_lib, except add in $libname$ to it...and nest that into the simpleresultstable...which simpleresultstable? The one generating the data on the tabs? Sorry this is just SO confusing!

0 Karma

sideview
SplunkTrust
SplunkTrust

Yea.. it's extremely unintuitive. You have to add a new HiddenSearch module that duplicates the savedsearch basically but has the little $foo$ token for the intention to plug into. =/ Nest that inside your SimpleResultsTable. As for the dashboard examples app ( http://apps.splunk.com/app/1265/ ) there are a lot of advanced xml examples in there. They may or may not be correctly linked from the nav. grep through the xml files for stringreplace. =/ Or go battle the dragons that are preventing the use of SVU.

0 Karma

tgeer123
Path Finder

So I would have to add $libname$ to my search string? When I do that - the table is then empty, and the job inspector shows that where $libname$ is - it shows "null". I looked for the dashboard examples but only see dashboard examples for simple xml?

0 Karma

sideview
SplunkTrust
SplunkTrust

OK. I think the remaining problem is that your stringreplace intention requires that you have a $libname$ token in the string. I know I said that $foo$ tokens and intentions are separate things (they are), but when a search is dispatched, the core Splunk UI basically evaluates intention arguments and replaces them into the corresponding $foo$ token - here $libname$. And if you don't have one for a given intention it throws it away and nothing gives you any error or warning. Review the stringreplace example that you'll find somewhere in the "dashboard examples" app.

0 Karma

sideview
SplunkTrust
SplunkTrust

It's really really confusing. $target$ is a ConvertToIntention thing. It really means $libname_setting$ since that's what you have in 'settingToConvert'. There's a newer ConvertToIntention syntax I put in, whereby you can just put $libname_setting$ in place of $target$ and NOT set settingToConvert at all. But yea the SimpleResultsHeader thing just says the click.value key is there. It has nothing to do with the intention.

0 Karma

tgeer123
Path Finder


libname_setting

stringreplace


$target$


0 Karma

tgeer123
Path Finder

Now when I click for example "NDL-W" - I have a simpleresultsheader (XML in original post) that reflects
Details for Remote Monitor Library NDL-W ADD-VALUES=libname="NDL-W"

Which is confusing to me since my intention with stringreplace uses $target$ not $click.value$

0 Karma

sideview
SplunkTrust
SplunkTrust

Can you post the xml to pastebin? I would normally tell you to put an HTML module in there to debug the key $foo$ tokens, or to use the Sideview Editor's Runtime Debug mode. =P. But it will be either module order (read framework_intro about when/where/why the splunk ui framework dispatches searches), or $foo$ token mismatch. When you say you can see the intention in SimpleResultsHeader I don't know what that could mean, because intentions are not $foo$ tokens and cant be treated as such.

0 Karma

tgeer123
Path Finder

I now have data showing up on page load..I had to change from addterm to stringreplace for the intention. When I click the intention appears to be passed down as it displays in the simpleresultsheader, but the records in the simple results table are not filtered by it. One step at a time!

0 Karma

tgeer123
Path Finder

It's not totally a money issue, its the hoops you gotta go through for approval. This particular project would take longer to get approval to use than we have in time left on contract 🙂 Believe me, I would prefer to be using it. I actually worked a side project that required it, and I was like, "I NEED THIS"! Alas, it is not approved, so I am stuck dealing with intentions and fussy custom code! Appreciate the help getting me this far!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...