Dashboards & Visualizations

TimeRangePickers, SearchSelectListers and the "applyOuterTimeRangeToInternalSearch" parameter

Jack_Davenport
Explorer

Hi

I've got a SearchSelectLister nested within a TimeRangePicker.

The SearchSelectLister has the "applyOuterTimeRangeToInternalSearch" parameter set to True and it almost works perfectly.

Problem is: the SearchSelectLister hangs on "Loading..." until I select a value for the TimeRangePicker, even when the TimeRangePicker has a default value!

Why is this the case? and how do i fix? 🙂

Thanks,

~ Jack

1 Solution

sideview
SplunkTrust
SplunkTrust

To make a long story short - you might try adding an autoRun="True" attribute at the top of that module tree - ie at the TimeRangePicker if the TimeRangePicker is the topmost module. That will probably make the problem go away.

And as another way this can happen - if there are is another autoRun="True" deeper in that XML, definitely remove it. If there are two or more autoRun="True" attributes in that XML, definitely remove the deeper one, and pull the upper one up as far as it'll go.

But if you post the XML it might well be caused by something else and I can update my answer accordingly.

View solution in original post

sideview
SplunkTrust
SplunkTrust

To make a long story short - you might try adding an autoRun="True" attribute at the top of that module tree - ie at the TimeRangePicker if the TimeRangePicker is the topmost module. That will probably make the problem go away.

And as another way this can happen - if there are is another autoRun="True" deeper in that XML, definitely remove it. If there are two or more autoRun="True" attributes in that XML, definitely remove the deeper one, and pull the upper one up as far as it'll go.

But if you post the XML it might well be caused by something else and I can update my answer accordingly.

sideview
SplunkTrust
SplunkTrust

Yea those are often harmless, depending on some very tweaky specifics in the XML, but whey they attack they are SUPER EVIL. There's actually a param I added to the SideviewUtils module called checkAutoRunAttributes. It's not something you want to use, but if you ever edit the SideviewUtils.conf file in etc/apps/sideview_utils/appserver/modules/SideviewUtils, set that to True and restart splunkWeb, in every view that has the problem, all users will get a big alert about it. My thinking was that concerned admins could turn it on, make a pass through all their views then turn it off.

0 Karma

Jack_Davenport
Explorer

Thanks very much!

It was caused by a deeper autoRun=True

Problem solved 🙂

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...