Splunk Enterprise

Link List View Issue After Splunk 9.4.1 Upgrade

Hussein_Desouky
Explorer

Hello,

After upgrading from Splunk 9.1.0 to 9.4.1, we’ve noticed a display issue affecting all dashboards that use Link List filters at the top. As shown in the screenshots below, the dashboard panels now appear above the Link List filters, making it difficult or impossible for users to interact with the buttons underneath.

Note: Converting the Link List to a Radio Button input resolves the issue, but I'm looking for a way to continue using the Link List as it worked in the previous version.

Has anyone experienced this or found a workaround?


Linklist1.pngLinklist2.png

 

 

 

 

 

 

 

 

Regards,

Labels (1)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Okay @Hussein_Desouky I think I have good news.

I was able to replicate this by using longer items in the link list. See below (there should be 4!) 

livehybrid_0-1746197173149.png

By adding the following HTML inside the <fieldset></fieldset> I was able to fix the issue, which is due to the inputs having a fixed height...

<html><style type="text/css">div[data-test="radio-bar"] { height:auto; } </style></html>

This then works (see below):

livehybrid_2-1746197240758.png

 

Full dashboard XML for my test:

<form version="1.1" theme="dark">
  <!-- Fieldset for dropdown input -->
  <fieldset submitButton="true" autoRun="true">
    <input type="link" token="field1">
      <label>field1</label>
      <choice value="Test1">Testing something longer</choice>
      <choice value="Test2">Testing2 something longer</choice>
      <choice value="Test3">Testing3 something longer</choice>
      <choice value="Test4">Test4 Test4 Test4 Test4 Test4 Test4</choice>
    </input>
        <html><style type="text/css">div[data-test="radio-bar"] { height:auto; } </style></html>

  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>|windbag</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</form>

 

So hopefully this will fix it for you too - however I do think this is a bug that needs raising to support. I'll raise it myself too but would be worth you raising it so they can allocate it to your account and keep you up to date with the progress of a permanent resolution.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

 

View solution in original post

livehybrid
SplunkTrust
SplunkTrust

Okay @Hussein_Desouky I think I have good news.

I was able to replicate this by using longer items in the link list. See below (there should be 4!) 

livehybrid_0-1746197173149.png

By adding the following HTML inside the <fieldset></fieldset> I was able to fix the issue, which is due to the inputs having a fixed height...

<html><style type="text/css">div[data-test="radio-bar"] { height:auto; } </style></html>

This then works (see below):

livehybrid_2-1746197240758.png

 

Full dashboard XML for my test:

<form version="1.1" theme="dark">
  <!-- Fieldset for dropdown input -->
  <fieldset submitButton="true" autoRun="true">
    <input type="link" token="field1">
      <label>field1</label>
      <choice value="Test1">Testing something longer</choice>
      <choice value="Test2">Testing2 something longer</choice>
      <choice value="Test3">Testing3 something longer</choice>
      <choice value="Test4">Test4 Test4 Test4 Test4 Test4 Test4</choice>
    </input>
        <html><style type="text/css">div[data-test="radio-bar"] { height:auto; } </style></html>

  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>|windbag</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</form>

 

So hopefully this will fix it for you too - however I do think this is a bug that needs raising to support. I'll raise it myself too but would be worth you raising it so they can allocate it to your account and keep you up to date with the progress of a permanent resolution.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

 

Hussein_Desouky
Explorer

Great, it worked for me as well. I’ll go ahead and mark this as the answer.

I’ll also raise a support ticket to solve this bug.

Thanks, @livehybrid 

Regards,

livehybrid
SplunkTrust
SplunkTrust

Hi @Hussein_Desouky 

This is unsual - it doesnt appear to behave this way for me - Are you using any custom CSS on your dashboard? Please could you try in incognito mode to rule out any cached CSS/JS on your browser?

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

Hussein_Desouky
Explorer

Hello @livehybrid,

Thank you for your prompt response.

There’s no custom CSS applied to the dashboard, and we’ve also tested in incognito mode with no success unfortunately.

The issue persists for all users within our organization, regardless of the browser being used.

Regards,

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...