Parallel Coordinates in a simple XML form

ivantn21 · ‎10-16-2013

I'm trying to add a drop down menu to the parallel coordinates visualization that is available on the Splunk 6 dashboard examples apps... But it seems to not work at all... any help?? here you have the view xml

<form script="autodiscover.js">
    <label>D3 Parallel Coordinates</label>
<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="source" searchWhenChanged="true">
<label>Select a Sourcetype:</label>
<prefix>sourcetype="</prefix>
<suffix>"</suffix>
<default>*</default>
<choice value="*">All</choice>
<populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
<![CDATA[index=_internal | stats count by sourcetype]]>
</populatingSearch>
</input>
</fieldset>
    <row>
        <html>
            <h2>Metrics: Pipeline</h2>

            <div id="custom_search"
                 class="splunk-manager"
                 data-require="splunkjs/mvc/searchmanager"
                 data-options='{
                        "search": "index=_internal $source$ component=Metrics group=pipeline | dedup 2 name,processor | table name processor cpu_seconds executes cummulative_hits",
                        "earliest_time": "-1h"
                    }'>
            </div>

            <div id="custom"
                 class="splunk-view"
                 data-require="app/simple_xml_examples/components/parallelcoords/parallelcoords"
                 data-options='{
                        "managerid": "custom_search",
                        "height": 400
                    }'>
            </div>

        </html>
    </row>
    <row>
        <html>
            <h2>Metrics: Queue</h2>

            <div id="custom_search2"
                 class="splunk-manager"
                 data-require="splunkjs/mvc/searchmanager"
                 data-options='{
                        "search": "index=_internal $source$ component=Metrics group=queue | dedup name | table name max_size_kb current_size largest_size smallest_size",
                        "earliest_time": "-1h"
                    }'>
            </div>

            <div id="custom2"
                 class="splunk-view"
                 data-require="app/simple_xml_examples/components/parallelcoords/parallelcoords"
                 data-options='{
                        "managerid": "custom_search2",
                        "height": 300
                    }'>
            </div>

        </html>
    </row>
</form>

nfilippi_splunk · ‎10-17-2013

Can you clarify what you mean by not work at all? Is this view within the simple_xml_examples app space, or do you have it in a separate app? If separate, do you have the referenced autodiscover.js in your appserver/static directory? Does it work if you remove the token reference within the search?

If it otherwise works when you remove the tokens in your search, then go ahead and try this xml to ensure that the search gets reloaded on token change.

<form script="autodiscover.js">
    <label>D3 Parallel Coordinates</label>
    <fieldset autoRun="true" submitButton="false">
        <input type="dropdown" token="source" searchWhenChanged="true">
            <label>Select a Sourcetype:</label>
            <prefix>sourcetype="</prefix>
            <suffix>"</suffix>
            <default>*</default>
            <choice value="*">All</choice>
            <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
                <![CDATA[index=_internal | stats count by sourcetype]]>
            </populatingSearch>
        </input>
        <input type="time" searchWhenChanged="true">
            <default>
                <earliestTime>-60m@m</earliestTime>
                <latestTime>now</latestTime>
            </default>
        </input>
    </fieldset>
    <row>
        <html>
            <h2>Metrics: Pipeline</h2>

            <div id="custom_search"
                 class="splunk-manager"
                 data-require="splunkjs/mvc/searchmanager"
                 data-options='{
                        "search": { "type": "token_safe", "value": "index=_internal $$source$$ component=Metrics group=pipeline | dedup 2 name,processor | table name processor cpu_seconds executes cummulative_hits" },
                        "earliest_time": { "type": "token_safe", "value": "$$earliest$$" },
                        "latest_time": { "type": "token_safe", "value": "$$latest$$" }
                    }'>
            </div>

            <div id="custom"
                 class="splunk-view"
                 data-require="app/simple_xml_examples/components/parallelcoords/parallelcoords"
                 data-options='{
                        "managerid": "custom_search",
                        "height": 400
                    }'>
            </div>

        </html>
    </row>
    <row>
        <html>
            <h2>Metrics: Queue</h2>

            <div id="custom_search2"
                 class="splunk-manager"
                 data-require="splunkjs/mvc/searchmanager"
                 data-options='{
                        "search": { "type": "token_safe", "value": "index=_internal $$source$$ component=Metrics group=queue | dedup name | table name max_size_kb current_size largest_size smallest_size" },
                        "earliest_time": { "type": "token_safe", "value": "$$earliest$$" },
                        "latest_time": { "type": "token_safe", "value": "$$latest$$" }
                    }'>
            </div>

            <div id="custom2"
                 class="splunk-view"
                 data-require="app/simple_xml_examples/components/parallelcoords/parallelcoords"
                 data-options='{
                        "managerid": "custom_search2",
                        "height": 300
                    }'>
            </div>

        </html>
    </row>
</form>

sajbutler · ‎09-17-2014

Yep. I can confirm that the token_safe you specified in the XML makes it work. Thanks so much!

ivantn21 · ‎10-17-2013

Thanks... I'm using it in the same example app... this xml did work... Thanks

Parallel Coordinates in a simple XML form

Can’t make it to .conf25? Join us online!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Calling All Security Pros: Ready to Race Through Boston?

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Are you a member of the Splunk Community?

Parallel Coordinates in a simple XML form

Can’t make it to .conf25? Join us online!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Calling All Security Pros: Ready to Race Through Boston?

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...