Splunk Enterprise

Link List View Issue After Splunk 9.4.1 Upgrade

Hussein_Desouky
Explorer

Hello,

After upgrading from Splunk 9.1.0 to 9.4.1, we’ve noticed a display issue affecting all dashboards that use Link List filters at the top. As shown in the screenshots below, the dashboard panels now appear above the Link List filters, making it difficult or impossible for users to interact with the buttons underneath.

Note: Converting the Link List to a Radio Button input resolves the issue, but I'm looking for a way to continue using the Link List as it worked in the previous version.

Has anyone experienced this or found a workaround?


Linklist1.pngLinklist2.png

 

 

 

 

 

 

 

 

Regards,

Labels (1)
0 Karma
1 Solution

livehybrid
Super Champion

Okay @Hussein_Desouky I think I have good news.

I was able to replicate this by using longer items in the link list. See below (there should be 4!) 

livehybrid_0-1746197173149.png

By adding the following HTML inside the <fieldset></fieldset> I was able to fix the issue, which is due to the inputs having a fixed height...

<html><style type="text/css">div[data-test="radio-bar"] { height:auto; } </style></html>

This then works (see below):

livehybrid_2-1746197240758.png

 

Full dashboard XML for my test:

<form version="1.1" theme="dark">
  <!-- Fieldset for dropdown input -->
  <fieldset submitButton="true" autoRun="true">
    <input type="link" token="field1">
      <label>field1</label>
      <choice value="Test1">Testing something longer</choice>
      <choice value="Test2">Testing2 something longer</choice>
      <choice value="Test3">Testing3 something longer</choice>
      <choice value="Test4">Test4 Test4 Test4 Test4 Test4 Test4</choice>
    </input>
        <html><style type="text/css">div[data-test="radio-bar"] { height:auto; } </style></html>

  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>|windbag</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</form>

 

So hopefully this will fix it for you too - however I do think this is a bug that needs raising to support. I'll raise it myself too but would be worth you raising it so they can allocate it to your account and keep you up to date with the progress of a permanent resolution.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

 

View solution in original post

livehybrid
Super Champion

Okay @Hussein_Desouky I think I have good news.

I was able to replicate this by using longer items in the link list. See below (there should be 4!) 

livehybrid_0-1746197173149.png

By adding the following HTML inside the <fieldset></fieldset> I was able to fix the issue, which is due to the inputs having a fixed height...

<html><style type="text/css">div[data-test="radio-bar"] { height:auto; } </style></html>

This then works (see below):

livehybrid_2-1746197240758.png

 

Full dashboard XML for my test:

<form version="1.1" theme="dark">
  <!-- Fieldset for dropdown input -->
  <fieldset submitButton="true" autoRun="true">
    <input type="link" token="field1">
      <label>field1</label>
      <choice value="Test1">Testing something longer</choice>
      <choice value="Test2">Testing2 something longer</choice>
      <choice value="Test3">Testing3 something longer</choice>
      <choice value="Test4">Test4 Test4 Test4 Test4 Test4 Test4</choice>
    </input>
        <html><style type="text/css">div[data-test="radio-bar"] { height:auto; } </style></html>

  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>|windbag</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</form>

 

So hopefully this will fix it for you too - however I do think this is a bug that needs raising to support. I'll raise it myself too but would be worth you raising it so they can allocate it to your account and keep you up to date with the progress of a permanent resolution.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

 

Hussein_Desouky
Explorer

Great, it worked for me as well. I’ll go ahead and mark this as the answer.

I’ll also raise a support ticket to solve this bug.

Thanks, @livehybrid 

Regards,

livehybrid
Super Champion

Hi @Hussein_Desouky 

This is unsual - it doesnt appear to behave this way for me - Are you using any custom CSS on your dashboard? Please could you try in incognito mode to rule out any cached CSS/JS on your browser?

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

Hussein_Desouky
Explorer

Hello @livehybrid,

Thank you for your prompt response.

There’s no custom CSS applied to the dashboard, and we’ve also tested in incognito mode with no success unfortunately.

The issue persists for all users within our organization, regardless of the browser being used.

Regards,

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...