Using "group" in LinkSwitcher

[Branden]

I'm am using a LinkSwitcher to switch between HiddenSavedSearches from a fixed time and HiddenSearches of a time selected via a TimeRangePicker.

I have a bunch of searches I'd like nested under each of these. And when the user goes to the dashboard, he/she will have a choice:

"Past 24 Hours" | "Pick a Time"

Unfortunately, whenever I add a search to a group, it creates a new link. Here's what I mean:

<module name="LinkSwitcher" layoutPanel="panel_row2_col1">
  <param name="mode">independent</param>
  <param name="label" />
  <module name="HiddenSavedSearch" group="Last 24 hours" autoRun="True">
     <param name="savedSearch">Check Errpt</param>
     <param name="useHistory">Auto</param>
     <module name="HiddenPostProcess">
        <param name="search">search host="xyz"</param>
        <module name="StaticContentSample" layoutPanel="panel_row2_col1">
           <param name="text">Errpt</param>
        </module>
        <module name="EventsViewer">
        </module>
     </module>
  </module>
  <module name="HiddenSavedSearch" group="Last 24 hours" autoRun="True">
     <param name="savedSearch">Check Paging</param>
     <param name="useHistory">Auto</param>
     <module name="HiddenPostProcess" layoutPanel="panel_row4_col1">
        <param name="search">search host="xyz" | timechart avg(percent_used) by page_dev</param>
        <module name="HiddenChartFormatter">
           <param name="chartTitle">Paging</param>
           <param name="chart">Line</param>
           <param name="primaryAxisTitle.text">Time</param>
           <param name="secondaryAxisTitle.text">Paging Percent</param>
           <module name="FlashChart" />
        </module>
     </module>
  </module>
 <module name="HiddenSavedSearch" group="Last 24 hours" autoRun="True">
     <param name="savedSearch">Check Paging</param>
     <param name="useHistory">Auto</param>
     <module name="HiddenPostProcess" layoutPanel="panel_row4_col2">
        <param name="search">search host="xyz" | timechart avg(percent_used) by page_dev</param>
        <module name="HiddenChartFormatter">
           <param name="chartTitle">Paging</param>
           <param name="chart">Line</param>
           <param name="primaryAxisTitle.text">Time</param>
           <param name="secondaryAxisTitle.text">Paging Percent</param>
           <module name="FlashChart" />
        </module>
     </module>
  </module>
  <module name="StaticContentSample" group="Pick A Time">
     <module name="TimeRangePicker">
        <param name="searchWhenChanged">True</param>
        <param name="selected">All time</param>
        <module name="HiddenSearch" group="Pick A Time" autoRun="True">
           <param name="search">| search host=xyz sourcetype="errpt"</param>
           <module name="EventsViewer" layoutPanel="panel_row3_col1">
           </module>
        </module>
        <module name="HiddenSearch" group="Paging" autoRun="True" layoutPanel="panel_row4_col1" >
              <param name="search">host="xyz" sourcetype="paging" | fields percent_used, page_dev | timechart avg(percent_used) by page_dev</param>
              <module name="HiddenChartFormatter">
                 <param name="chart">Line</param>
                 <param name="primaryAxisTitle.text">Time</param>
                 <param name="secondaryAxisTitle.text">Paging Percent</param>
                 <module name="FlashChart" />
           </module>
        </module>
        <module name="HiddenSearch" group="Paging" autoRun="True" layoutPanel="panel_row4_col2">
              <param name="search">host="xyz" sourcetype="paging" | fields percent_used, page_dev | timechart avg(percent_used) by page_dev</param>
              <module name="HiddenChartFormatter">
                 <param name="chart">Line</param>
                 <param name="primaryAxisTitle.text">Time</param>
                 <param name="secondaryAxisTitle.text">Paging Percent</param>
                 <module name="FlashChart" />
           </module>
        </module>
     </module>
  </module>

etc...

That code produces the following links:

"Past 24 Hours" | "Past 24 Hours" | "Past 24 Hours" | "Pick a Time"

Each of those "Past 24 Hours" takes you to a different HiddenSavedSearch. That's not what I want. I'd like the user to click "Past 24 Hours" and have all the searches kick off and be visible.

I have a dashboard doing this that works fine, but not in the context of a Switcher.

Can anyone tell me what I'm doing wrong?

Thanks!

[Starlette]

<view template="dashboard.html">
  <label>Development</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>

  <module name="LinkSwitcher" layoutPanel="panel_row1_col1">
    <param name="mode">independent</param>
    <param name="label"> </param>

    <module name="NullModule" group="Operations Overview" autoRun="True">
    <module name="HiddenSavedSearch"> 
      <param name="savedSearch">dev_eventcount</param>
      <module name="HiddenChartFormatter">
        <param name="chart">line</param>
        <param name="primaryAxisTitle.text">CPU seconds</param>
        <param name="secondaryAxisTitle.text">Pipeline processors</param>
        <param name="legend.placement">right</param>
         <module name="FlashChart">
          <param name="width">100%</param>
          <param name="height">300px</param>
        </module>
      </module>
    </module>

    <module name="HiddenSavedSearch">
      <param name="savedSearch">dev_eventcount</param>
      <module name="HiddenChartFormatter">
        <param name="chart">line</param>
        <param name="primaryAxisTitle.text">CPU seconds</param>
        <param name="secondaryAxisTitle.text">Pipeline processors</param>
        <param name="legend.placement">right</param>
        <module name="JobProgressIndicator"/>
        <module name="FlashChart">
          <param name="width">100%</param>
          <param name="height">300px</param>
        </module>
      </module>
    </module>


<module name="TimeRangePicker"> group="Operations Overview choose time" autoRun="True">
   <param name="searchWhenChanged">True</param>
  <param name="selected">All time</param>
  <module name="HiddenSavedSearch">
  <param name="useHistory">false</param>
  <param name="savedSearch">ferrydev_eventcount</param>
   <module name="ResultsHeader">
      <param name="entityName">scanned</param>
      <param name="entityLabel">events scanned</param>
      <module name="HiddenChartFormatter">
                <param name="chart">line</param>
                <param name="primaryAxisTitle.text">Time</param>
                <param name="secondaryAxisTitle.text">Events over choosen timeinterval</param>
                <module name="FlashChart">
                <param name="width">100%</param>
                <param name="height">200px</param>
                </module>          
      </module>
    </module>
  </module>
  </module>

</module>
</module>
     </view>

So I ended up with a single switch with everything under it,,,cant manage to get this right,,,any tips?

[David]

You have a typo with the TimeRangePicker, where you have an extra ">. Does it work if you take that out? If not, try moving one of the statements from the end to just before the TimeRangePicker.

[sideview]

Sure thing. Each of the children of a switcher automatically become a new group. The solution is to take the stuff you want under only one tab, and wrap those children under a single common parent. So to the LinkSwitcher or PulldownSwitcher or whatever switcher class you're using, they are all a single child and thus a single link/option/tab/etc.

In this case there's no logical common parent involved but that's OK - you can always use a "NullModule" module.

So you can factor up the autoRun attributes and the group attributes. I also removed the StaticContentSample module cause it didnt look like it was doing anything.

Here's a quick sketch. Hopefully this is clear:

<module name="LinkSwitcher" layoutPanel="panel_row2_col1">
  <param name="mode">independent</param>
  <param name="label" />

  <module name="NullModule" group="Last 24 hours" autoRun="True">
    <module name="HiddenSavedSearch">
      [[ etc...]]
    </module>
    <module name="HiddenSavedSearch">
      [[ etc...]]
    </module>
    <module name="HiddenSavedSearch">
      [[ etc...]]
    </module>

  <module name="TimeRangePicker" group="Pick a Time">
    [[ everything else]]]
  </module>
 </module>

And if you havent already, download the "UI Examples for 4.1" app from splunkbase and load it up in your instance and read through all of its examples and it's explanations carefully. (MAKE SURE not to download the "UI Examples" app because that is app is quite old and out of date)