Dashboards & Visualizations

LinkSwitcher is not displaying properly a "rt" map

jsimbola
New Member

Hello !

I'd like to plot the result of a query on a 3 seperate maps (rt, last 24h, last 7d) but I'm facing a strange bug.
I've configured the "LinkSwitcher" in "independant" mode but it is designing a big box able to store the three maps, like in "serializedall" mode... As a result, I've got a big white box with my map on the top.
I've reproduced this bug with the other switchers modules.

Please, note that this bug disapears if I add other boxes using panel_row_col layouts, based on another HiddenSearch on a specified search window ( "-7d to now" for example). But if I specifies a realtime search window like that for example :


rt-5m
rt

the same bug appears again...

As a consequence, I think that there is something wrong with LinkSwitcher and rt hiddenSearch, but I don't know how to cope with that. The bad thing is that I can't fiddle with the css because I'm writing an independent App intended to be installed on splunk servers that I won't manage...

Fyi, I'm working with Splunk v5.0.1
PLease find below a little xml form which is producing my bug. I also have a screenshot if you want.

Thank you in advance
best regards
Julien



  

  
  
  
    *
    False
    1
  


  
    sourcetype=beeware AND bw_log_source != "Event Logs" bw_log_class=BLOCKED OR bw_log_class=ALERT | search icx_src_ip!=192.168.0.0/16 icx_src_ip!=10.0.0.0/8 icx_src_ip!=172.16.0.0/20 |  stats count by icx_src_ip | eval count_label="Attack" | eval iterator="icx_src_ip" | eval iterator_label="Source IP" |  eval zoom = "zoom=\"250%\" zoom_x=\"0%\" zoom_y=\"-75%\""| eval movie_color="#FF0000" | eval output_file="rt_threat_data.xml" | eval app="beeware" | lookup geoip clientip as icx_src_ip | mapit
        rt-5m
        rt

     



      
    independent
     

    
    rt_map.html
  
  
    24h_map.html
  
    
    7d_map.html
  



0 Karma

jsimbola
New Member

Hi all,

For those who are facing the same issue, I've found a workaroud by replacing the panel_row_col layout panels of the LinkSwitcher and ServerSideInclude modules with "viewHeader".

best regards
Julien

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...