Dashboards & Visualizations
Highlighted

Why is it when I drilldown from the second page of my results from a table on my dashboard it shows "No results found"?

Explorer

Hey,

I developed a dashboard which analyzes failed logons of user on a systems with different operating systems.
This is my XML:

<form>
  <label>Fehlanmeldungen auf einem System</label>
  <fieldset autorun="true">
    <input type="radio" token="userType">
      <label>User</label>
      <default>natural</default>
      <choice value="natural">J-User</choice>
      <choice value="tech">technische User</choice>
    </input>
    <input type="radio" token="os">
      <label>Betriebssystem</label>
      <default>Linux</default>
      <choice value="aix">AIX</choice>
      <choice value="linux">Linux</choice>
      <choice value="solaris">Solaris</choice>
      <choice value="windows">Windows</choice>
    </input>
    <input type="text" token="ip" searchWhenChanged="true">
      <default>*</default>
      <label>Quell-/Zielhost</label>
    </input>
    <input type="text" token="user" searchWhenChanged="true">
      <default>*</default>
      <label>User</label>
    </input>
    <input type="time" token="timerange">
      <label>Zeitraum</label>
      <default>
        <earliest>-7d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <table>
      <title>Fehlanmeldungen von $userType$-Usern auf dem $os$-System mit der IP-Adresse $ip$ der letzten 7 Tage</title>
      <search>
        <query>| savedsearch fi_UI_MoOpS_failed-logons-$os$-$userType$ ip=$ip$ user=$user$</query>
        <earliest>$timerange.earliest$</earliest>
        <latest>$timerange.latest$</latest>
      </search>
      <drilldown>
        <condition field="UserID">
          <set token="form.ip">*</set>
          <set token="form.user">$click.value2$</set>
        </condition>
        <condition field="Zielsysteme">
          <set token="form.ip">$click.value2$</set>
          <set token="form.user">*</set>
        </condition>
        <condition field="Quellsysteme">
          <set token="form.ip">$click.value2$</set>
          <set token="form.user">*</set>
        </condition>
        <condition field="*">
          <set token="form.ip">*</set>
          <set token="form.user">*</set>
        </condition>
        </drilldown>
    </table>
  </row>
</form>

When I click on a userID or a system IP, the input values change, like I expect them to do. The search restarts with new parameters.

Now the problem:
When I start the drilldown from the first page of the result table on this form everything works fine. But when I select a userID from another page than the first, the tokens were set correctly and the search restarts too, but it displays "no results found". In search view the same search gives me the expected result and in the inspector the resultcount of this drilldown is 1, like I expect. Is it a problem of displaying the results caused by the JS, because it is only loaded correctly on the first result page?

I know, that it is possible to rewrite the drilldowns with links to the same page, but then the whole page reloads and I don't want the page to do this, because of usability etc.

Does anyone has an idea, why an drilldown from the first result page in the table is working fine but from any other result page in the table isn't? Every little hint can help.

Thank You!

Highlighted

Re: Why is it when I drilldown from the second page of my results from a table on my dashboard it shows "No results found"?

Legend

Is there an option to go to page 1, after the search is complete? Here's my thinking. When you are on page 2 and refresh the search, since the new search only returns 1 page worth of results, the UI is trying to show page 2, which has 0 results. This just a guess.

Highlighted

Re: Why is it when I drilldown from the second page of my results from a table on my dashboard it shows "No results found"?

Legend

Does it behave this way on all browsers?

0 Karma
Highlighted

Re: Why is it when I drilldown from the second page of my results from a table on my dashboard it shows "No results found"?

Explorer

@Iguinn: At our company i am only able to test with IE11 and Firefox. In both of them the same reaction.

0 Karma
Highlighted

Re: Why is it when I drilldown from the second page of my results from a table on my dashboard it shows "No results found"?

Explorer

@sundareshr: i don't know any option for that, but i am trying a little JavaScript.

0 Karma
Highlighted

Re: Why is it when I drilldown from the second page of my results from a table on my dashboard it shows "No results found"?

Champion

I've had the exact same problem, it happens because the table pagination stays on page 2 (or whatever higher page you were on before drilling down) and when the new result set is smaller and doesn't have a page 2, the table displays "No Results" instead of resetting to page 1. Here's how I solved it.
You give the table an id, attach a listener to it in js and reset the table pagination to page 1 each time it reloads because of a drilldown. Simple XML should look something like this

<form script="resetTablePagination.js">
  <label>Fehlanmeldungen...

to include custom js code and

...
</fieldset>
<row>
  <table id="table">
    <title>Fehlanmeldungen...

to give your table an id. In resetTablePagination.js, you need the following:

require([
        'splunkjs/mvc',
        'splunkjs/mvc/simplexml/ready!'
    ], function (mvc) {

    var table = mvc.Components.get("table"); // Get the table

    table.on('click', function() {
        table.visualization.paginator.settings.set("page", 0); // Reset the paginator
        table.visualization.resultsModel.attributes.offset = 0; // Reset the page of the results the table tries to display
    });
});

The .js file goes in %SPLUNK_HOME/etc/apps/your_app/appserver/static and splunkweb needs to be restarted to pick up new files.

View solution in original post

Highlighted

Re: Why is it when I drilldown from the second page of my results from a table on my dashboard it shows "No results found"?

Explorer

Thank you, it works. That`s what I was trying to do the last hour.

Thank you all.

Highlighted

Re: Why is it when I drilldown from the second page of my results from a table on my dashboard it shows "No results found"?

Contributor

This is awesome, as I had the same issue, however I am not using a drilldown from within the table, so I'm guessing table.on('click',... needs to be replaced with something along the lines of submitButton.on('click',...? The question then becomes how to get the submitButton? I can't give it an id in my simple XML, because all I have is <fieldset submitButton="true" ... can anybody help a bit further?

0 Karma
Highlighted

Re: Why is it when I drilldown from the second page of my results from a table on my dashboard it shows "No results found"?

Explorer

I have the same problem. All i am using is a drop down and table inside a panel.
Based on the drop down selection the table must populate.

0 Karma
Highlighted

Re: Why is it when I drilldown from the second page of my results from a table on my dashboard it shows "No results found"?

Champion

Then you can give the drop down an id and listen to the change event on it instead of the click event of a table.

0 Karma