SingleValue Module Changes in 5.0

[gvmorley]

Hi,

In Splunk 5.0, does anyone know if there is a way to made the SingleValue Module display coloured boxes, as it did in 4.3.x? We use this module extensively in AdvancedXML Views.

We're just starting to test 5.0 and a number of our users feel that changing the SingleValue Module from a coloured box, to just coloured text, is less clear for alerting-style dashboards.

I've checked the module reference here and can't see any setting which would apply:

http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModuleReference#SingleValue

Any thoughts?

[sideview]

If you download the latest Sideview Utils (2.2.5) from the Sideview site ( http://sideviewapps.com/apps/sideview-utils/ ), it packages many modules one of which is the HTML module.

the HTML module has many benefits, but one of them is that you can use it to replace SingleValue very easily. And along the way, you can get dynamic links on your little values, you can control the HTML, plus using other Sideview modules you have tons more flexibility in general.

But for an example of using HTML instead of SingleValue, try this:

<module name="Search" layoutPanel="panel_row1_col1">
  <param name="search">index=_internal source=*metrics.log group=per_sourcetype_thruput | stats sum(kb) as KB by series | sort - sumKB | head 1 | rangemap field=KB low=0-0.99 guarded=1-499.99 elevated=500-4999.99 high=5000-99999999 severe=100000000-100000000000000</param>
  <param name="earliest">-15min</param>

  <module name="HTML">
    <param name="html"><![CDATA[
      <div class="valueDisplay">
        <div class="inner $results[0].range$">
          <b>total KB = $results[0].KB$</b>
        </div>
      </div>
      <br clear="all">
    ]]></param>
  </module>
</module>

This is one of the few cases where the Sideview module doesn't give you more compact XML than the equivalent Splunk module, in fact with the raw HTML like that it's a little larger than the equivalent SingleValue module. Nonetheless I think you'll appreciate the openness of just being able to write your own markup directly.

NOTE: for further reading there's a whole section of documentation within the Sideview Utils app, dedicated to just the HTML module. (Module Reference > HTML > *) And in particular there's an entire page devoted to using HTML to replace SingleValue (Module Reference > HTML > Using HTML instead of the SingleValue module)

http://sideviewapps.com/apps/sideview-utils/

[gvmorley]

Hi,

Thanks for the information. Yes, sideview is an option. But I'd like to hear what other people have to say, as for our user community, it appears that the Splunk 5.0 UI has removed something that they relied upon.