Dashboards & Visualizations

Why is it when I drilldown from the second page of my results from a table on my dashboard it shows "No results found"?

huszti21
Explorer

Hey,

I developed a dashboard which analyzes failed logons of user on a systems with different operating systems.
This is my XML:

<form>
  <label>Fehlanmeldungen auf einem System</label>
  <fieldset autorun="true">
    <input type="radio" token="userType">
      <label>User</label>
      <default>natural</default>
      <choice value="natural">J-User</choice>
      <choice value="tech">technische User</choice>
    </input>
    <input type="radio" token="os">
      <label>Betriebssystem</label>
      <default>Linux</default>
      <choice value="aix">AIX</choice>
      <choice value="linux">Linux</choice>
      <choice value="solaris">Solaris</choice>
      <choice value="windows">Windows</choice>
    </input>
    <input type="text" token="ip" searchWhenChanged="true">
      <default>*</default>
      <label>Quell-/Zielhost</label>
    </input>
    <input type="text" token="user" searchWhenChanged="true">
      <default>*</default>
      <label>User</label>
    </input>
    <input type="time" token="timerange">
      <label>Zeitraum</label>
      <default>
        <earliest>-7d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <table>
      <title>Fehlanmeldungen von $userType$-Usern auf dem $os$-System mit der IP-Adresse $ip$ der letzten 7 Tage</title>
      <search>
        <query>| savedsearch fi_UI_MoOpS_failed-logons-$os$-$userType$ ip=$ip$ user=$user$</query>
        <earliest>$timerange.earliest$</earliest>
        <latest>$timerange.latest$</latest>
      </search>
      <drilldown>
        <condition field="UserID">
          <set token="form.ip">*</set>
          <set token="form.user">$click.value2$</set>
        </condition>
        <condition field="Zielsysteme">
          <set token="form.ip">$click.value2$</set>
          <set token="form.user">*</set>
        </condition>
        <condition field="Quellsysteme">
          <set token="form.ip">$click.value2$</set>
          <set token="form.user">*</set>
        </condition>
        <condition field="*">
          <set token="form.ip">*</set>
          <set token="form.user">*</set>
        </condition>
        </drilldown>
    </table>
  </row>
</form>

When I click on a userID or a system IP, the input values change, like I expect them to do. The search restarts with new parameters.

Now the problem:
When I start the drilldown from the first page of the result table on this form everything works fine. But when I select a userID from another page than the first, the tokens were set correctly and the search restarts too, but it displays "no results found". In search view the same search gives me the expected result and in the inspector the resultcount of this drilldown is 1, like I expect. Is it a problem of displaying the results caused by the JS, because it is only loaded correctly on the first result page?

I know, that it is possible to rewrite the drilldowns with links to the same page, but then the whole page reloads and I don't want the page to do this, because of usability etc.

Does anyone has an idea, why an drilldown from the first result page in the table is working fine but from any other result page in the table isn't? Every little hint can help.

Thank You!

1 Solution

jeffland
SplunkTrust
SplunkTrust

I've had the exact same problem, it happens because the table pagination stays on page 2 (or whatever higher page you were on before drilling down) and when the new result set is smaller and doesn't have a page 2, the table displays "No Results" instead of resetting to page 1. Here's how I solved it.
You give the table an id, attach a listener to it in js and reset the table pagination to page 1 each time it reloads because of a drilldown. Simple XML should look something like this

<form script="resetTablePagination.js">
  <label>Fehlanmeldungen...

to include custom js code and

...
</fieldset>
<row>
  <table id="table">
    <title>Fehlanmeldungen...

to give your table an id. In resetTablePagination.js, you need the following:

require([
        'splunkjs/mvc',
        'splunkjs/mvc/simplexml/ready!'
    ], function (mvc) {

    var table = mvc.Components.get("table"); // Get the table

    table.on('click', function() {
        table.visualization.paginator.settings.set("page", 0); // Reset the paginator
        table.visualization.resultsModel.attributes.offset = 0; // Reset the page of the results the table tries to display
    });
});

The .js file goes in %SPLUNK_HOME/etc/apps/your_app/appserver/static and splunkweb needs to be restarted to pick up new files.

View solution in original post

sansay1
Explorer

Today is June 24th of 2021, and I am sad to report that this issue is still there. I just added a dropdown listbox so that the user can change the number of rows displayed. And found out that if the user gets 18 results with the default pagination set to 20 rows, and then changes it to 10, navigate to the second page, and select the 20 rows pagination, the view is stuck on showing the 8 last records. Not only that but the page selection disappears unless you re-select the 10 rows
I am amazed that in so many years this has not been fixed.

0 Karma

jeffland
SplunkTrust
SplunkTrust

I've had the exact same problem, it happens because the table pagination stays on page 2 (or whatever higher page you were on before drilling down) and when the new result set is smaller and doesn't have a page 2, the table displays "No Results" instead of resetting to page 1. Here's how I solved it.
You give the table an id, attach a listener to it in js and reset the table pagination to page 1 each time it reloads because of a drilldown. Simple XML should look something like this

<form script="resetTablePagination.js">
  <label>Fehlanmeldungen...

to include custom js code and

...
</fieldset>
<row>
  <table id="table">
    <title>Fehlanmeldungen...

to give your table an id. In resetTablePagination.js, you need the following:

require([
        'splunkjs/mvc',
        'splunkjs/mvc/simplexml/ready!'
    ], function (mvc) {

    var table = mvc.Components.get("table"); // Get the table

    table.on('click', function() {
        table.visualization.paginator.settings.set("page", 0); // Reset the paginator
        table.visualization.resultsModel.attributes.offset = 0; // Reset the page of the results the table tries to display
    });
});

The .js file goes in %SPLUNK_HOME/etc/apps/your_app/appserver/static and splunkweb needs to be restarted to pick up new files.

manojkrishnan
Engager

Hi jeffland,

i am getting the error " Uncaught TypeError: Cannot read property 'paginator' of undefined" when am implementing the given code .Kindly suggest me a solution .

0 Karma

jeffland
SplunkTrust
SplunkTrust

Sounds like you didn't properly get the table by id. Make sure to give it an id in Simple XML like this

<table id="table">

and use that id in js with mvc.Components.get("table");

0 Karma

gabriel_vasseur
Contributor

This is awesome, as I had the same issue, however I am not using a drilldown from within the table, so I'm guessing table.on('click',... needs to be replaced with something along the lines of submitButton.on('click',...? The question then becomes how to get the submitButton? I can't give it an id in my simple XML, because all I have is <fieldset submitButton="true" ... can anybody help a bit further?

0 Karma

jeffland
SplunkTrust
SplunkTrust

You could either append a change listener to the inputs, or you could in fact listen to the search manager start event. Both is covered in the Web Framework Reference.

0 Karma

email2vamsi
Explorer

I have the same problem. All i am using is a drop down and table inside a panel.
Based on the drop down selection the table must populate.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Then you can give the drop down an id and listen to the change event on it instead of the click event of a table.

0 Karma

huszti21
Explorer

Thank you, it works. That`s what I was trying to do the last hour.

Thank you all.

sundareshr
Legend

Is there an option to go to page 1, after the search is complete? Here's my thinking. When you are on page 2 and refresh the search, since the new search only returns 1 page worth of results, the UI is trying to show page 2, which has 0 results. This just a guess.

huszti21
Explorer

@sundareshr: i don't know any option for that, but i am trying a little JavaScript.

0 Karma

lguinn2
Legend

Does it behave this way on all browsers?

0 Karma

huszti21
Explorer

@Iguinn: At our company i am only able to test with IE11 and Firefox. In both of them the same reaction.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...