Dashboards & Visualizations

Multiple forms with an Input Field and TimeRangePicker - No Repeat Input

beaumaris
Communicator

I have a dashboard with several panels each having an input field, TimeRangePicker, and a search button. After input and when the search completes, the graph is generated but the 'view_result' link does not show and the vertical size bar is partially hidden behind the panel. More importantly, I am unable to enter data or search again on that panel. Attached is the Advanced XML for the panel.

I may have an ordering problem but if I move the input controls to be under the HiddenSearch, I get a 'no child module' error. Is there a better way to organize this panel?

<!-- PANEL #1 -->
<module name="GenericHeader" layoutPanel="panel_row1_col1">
  <param name="label">Frequency of Visitor Return</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="search">| noop</param>
  <module name="ExtendedFieldSearch">
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="client_ip">
          <param name="default"></param>
          <param name="fillOnEmpty">True</param>
          <param name="value">$target$</param>
         </param>
      </param>
    </param>
    <param name="replacementMap">
      <param name="arg">
        <param name="client_ip">
          <param name="value"></param>
        </param>
      </param>
    </param>
    <param name="field">Client IP Address</param>

    <!-- The Time Range dropdown definition -->
    <module name="TimeRangePicker">
      <param name="searchWhenChanged">True</param>
      <module name="SubmitButton">
        <param name="allowSoftSubmit">True</param>
        <param name="label">Search</param>

        <module name="HiddenSearch" layoutPanel="panel_row1_col1">
          <param name="search">`Frequency_of_Visitor_Return($client_ip$)`</param>
          <module name="ViewstateAdapter">
            <module name="HiddenFieldPicker">
              <param name="strictMode">True</param>
              <module name="JobProgressIndicator">
                <module name="EnablePreview">
                  <param name="enable">True</param>
                  <param name="display">False</param>
                  <module name="HiddenChartFormatter">
                    <param name="charting.primaryAxisTitle.text">Date/Time</param>
                    <param name="charting.secondaryAxisTitle.text">Count</param>
                    <param name="charting.legend.placement">none</param>
                    <param name="charting.chart">column</param>
                    <module name="FlashChart">
                      <param name="width">100%</param>
                      <module name="ConvertToDrilldownSearch">
                        <module name="ViewRedirector">
                          <param name="viewTarget">flashtimeline</param>
                        </module>
                      </module>
                    </module>
                    <module name="ViewRedirectorLink">
                      <param name="viewTarget">flashtimeline</param>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

sideview
SplunkTrust
SplunkTrust

If the ViewRedirectorLink module is not showing, and the resize bar on the FlashChart is getting displayed in a wonky fashion, I'd look for any custom CSS. It sounds like something in application.css is messing with floats.

as far as the XML, there is some redundant XML in here, but nothing that I can see that would cause the ViewRedirectorLink to render weird or behind the chart.

some of the extra XML is vestigial from when the view was converted from the Simplified XML to the advanced XML. The Simplified XML has some bugs where it does some weird things and these come out later when it gets converted to the underlying format:

  • JobProgressIndicator doesnt need to nest any modules inside it, in fact this is meaningless.
  • EnablePreview doesnt need to nest any modules inside it either (also meaningless).
    It just needs to be living down at or below the level where the search will get kicked off.
  • HiddenFieldPicker and ViewStateAdapter are meaningless in your case.

So I fixed those for you. In addition you had one other piece of extra XML:

-- you had a HiddenSearch at the top with a 'noop' search in it. This wasnt doing anything so I removed it.

<!-- PANEL #1 -->
<module name="GenericHeader" layoutPanel="panel_row1_col1">
  <param name="label">Frequency of Visitor Return</param>
</module>
<module name="ExtendedFieldSearch" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="field">Client IP Address</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="client_ip">
        <param name="default"></param>
        <param name="fillOnEmpty">True</param>
        <param name="value">$target$</param>
       </param>
    </param>
  </param>
  <param name="replacementMap">
    <param name="arg">
      <param name="client_ip">
        <param name="value"></param>
      </param>
    </param>
  </param>

  <!-- The Time Range dropdown definition -->
  <module name="TimeRangePicker">
    <param name="searchWhenChanged">True</param>
    <module name="SubmitButton">
      <param name="allowSoftSubmit">True</param>
      <param name="label">Search</param>

      <module name="HiddenSearch" layoutPanel="panel_row1_col1">
        <param name="search">`Frequency_of_Visitor_Return($client_ip$)`</param>
          <module name="JobProgressIndicator"></module>
          <module name="EnablePreview">
            <param name="enable">True</param>
            <param name="display">False</param>
          </module>

          <module name="HiddenChartFormatter">
            <param name="charting.primaryAxisTitle.text">Date/Time</param>
            <param name="charting.secondaryAxisTitle.text">Count</param>
            <param name="charting.legend.placement">none</param>
            <param name="charting.chart">column</param>
            <module name="FlashChart">
              <param name="width">100%</param>
              <module name="ConvertToDrilldownSearch">
                <module name="ViewRedirector">
                  <param name="viewTarget">flashtimeline</param>
                </module>
              </module>
            </module>
            <module name="ViewRedirectorLink">
              <param name="viewTarget">flashtimeline</param>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...