Dashboards & Visualizations

LinkSwitcher is not displaying properly a "rt" map

jsimbola
New Member

Hello !

I'd like to plot the result of a query on a 3 seperate maps (rt, last 24h, last 7d) but I'm facing a strange bug.
I've configured the "LinkSwitcher" in "independant" mode but it is designing a big box able to store the three maps, like in "serializedall" mode... As a result, I've got a big white box with my map on the top.
I've reproduced this bug with the other switchers modules.

Please, note that this bug disapears if I add other boxes using panel_row_col layouts, based on another HiddenSearch on a specified search window ( "-7d to now" for example). But if I specifies a realtime search window like that for example :


rt-5m
rt

the same bug appears again...

As a consequence, I think that there is something wrong with LinkSwitcher and rt hiddenSearch, but I don't know how to cope with that. The bad thing is that I can't fiddle with the css because I'm writing an independent App intended to be installed on splunk servers that I won't manage...

Fyi, I'm working with Splunk v5.0.1
PLease find below a little xml form which is producing my bug. I also have a screenshot if you want.

Thank you in advance
best regards
Julien



  

  
  
  
    *
    False
    1
  


  
    sourcetype=beeware AND bw_log_source != "Event Logs" bw_log_class=BLOCKED OR bw_log_class=ALERT | search icx_src_ip!=192.168.0.0/16 icx_src_ip!=10.0.0.0/8 icx_src_ip!=172.16.0.0/20 |  stats count by icx_src_ip | eval count_label="Attack" | eval iterator="icx_src_ip" | eval iterator_label="Source IP" |  eval zoom = "zoom=\"250%\" zoom_x=\"0%\" zoom_y=\"-75%\""| eval movie_color="#FF0000" | eval output_file="rt_threat_data.xml" | eval app="beeware" | lookup geoip clientip as icx_src_ip | mapit
        rt-5m
        rt

     



      
    independent
     

    
    rt_map.html
  
  
    24h_map.html
  
    
    7d_map.html
  



0 Karma

jsimbola
New Member

Hi all,

For those who are facing the same issue, I've found a workaroud by replacing the panel_row_col layout panels of the LinkSwitcher and ServerSideInclude modules with "viewHeader".

best regards
Julien

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...