Dashboards & Visualizations

LinkSwitcher is not displaying properly a "rt" map

jsimbola
New Member

Hello !

I'd like to plot the result of a query on a 3 seperate maps (rt, last 24h, last 7d) but I'm facing a strange bug.
I've configured the "LinkSwitcher" in "independant" mode but it is designing a big box able to store the three maps, like in "serializedall" mode... As a result, I've got a big white box with my map on the top.
I've reproduced this bug with the other switchers modules.

Please, note that this bug disapears if I add other boxes using panel_row_col layouts, based on another HiddenSearch on a specified search window ( "-7d to now" for example). But if I specifies a realtime search window like that for example :


rt-5m
rt

the same bug appears again...

As a consequence, I think that there is something wrong with LinkSwitcher and rt hiddenSearch, but I don't know how to cope with that. The bad thing is that I can't fiddle with the css because I'm writing an independent App intended to be installed on splunk servers that I won't manage...

Fyi, I'm working with Splunk v5.0.1
PLease find below a little xml form which is producing my bug. I also have a screenshot if you want.

Thank you in advance
best regards
Julien



  

  
  
  
    *
    False
    1
  


  
    sourcetype=beeware AND bw_log_source != "Event Logs" bw_log_class=BLOCKED OR bw_log_class=ALERT | search icx_src_ip!=192.168.0.0/16 icx_src_ip!=10.0.0.0/8 icx_src_ip!=172.16.0.0/20 |  stats count by icx_src_ip | eval count_label="Attack" | eval iterator="icx_src_ip" | eval iterator_label="Source IP" |  eval zoom = "zoom=\"250%\" zoom_x=\"0%\" zoom_y=\"-75%\""| eval movie_color="#FF0000" | eval output_file="rt_threat_data.xml" | eval app="beeware" | lookup geoip clientip as icx_src_ip | mapit
        rt-5m
        rt

     



      
    independent
     

    
    rt_map.html
  
  
    24h_map.html
  
    
    7d_map.html
  



0 Karma

jsimbola
New Member

Hi all,

For those who are facing the same issue, I've found a workaroud by replacing the panel_row_col layout panels of the LinkSwitcher and ServerSideInclude modules with "viewHeader".

best regards
Julien

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...