Sideview-Utils: How to create a line chart

[Splunkster45]

I've been using splunk for a few months and am just now beginning to use sideview utils. I've found how to make a table (SimpleResultsTable or Table) and I've found how to make a bar chart (JSChart), however I can't figure out how to make a line chart.

Maybe I'm missing something... Any help would be appreciated.

Also, what I eventually want to do is to be able to create 5 charts/tables/statistics query on a page and then be able to have 1 drop down menu at the top that will let me change the value of a sourcetype for every chart/table/statistic query on the page. E.g. all charts/etc have soucetype = A and then when I use the drop down menu, all charts/etc. have sourcetype =B. Is that possible? I'm looking into pull downs and the like, but I can't tell it I can fully do that.

Thanks and have a great weekend!

[sideview · Accepted solution]

It is remarkable that nothing in the docs says how to do this. In a nutshell,

<module name="ValueSetter">
  <param name="arg.charting.chart">line</param>
  <module name="JSChart" />
</module>

The Sideview Utils docs still retain too much of the flavor from the early days when the app was a bunch of extra things added onto the Advanced XML. And as such, readers would already have familiarity with the charting framework keys like "charting.chart" and the HiddenChartFormatter module. These days the "Sideview XML" has kind of taken over, the users no longer enter with much familiarity, if any, of the legacy advanced XML systems and modules, and the docs will have to be rewritten relatively soon, to reflect that.

[Splunkster45]

Thanks for the reply. I would say that I fit into the realm of those people who use sideview xml, but do not have an familiarity with the legacy advanced xml.

Honestly, I tried putting a JSChart inside a Valuesetter, but was unable to come up with a line chart. Maybe there are a few other steps that I'm not familiar with... However, I was able to go a different route to create a line chart by using the modules Search - HiddenChartFormatter - FlashChart as follows:

   <module name="Search" layoutPanel="panel_row2_col1">
      <param name="search"><![CDATA[...search...]]></param>
      <module name="HiddenChartFormatter" autoRun="True">
        <param name="chart.nullValueMode">zero</param>
        <param name="chart">line</param>
        <param name="chartTitle">ChartTitle</param>
        <module name="FlashChart" />
      </module>
    </module>

By setting "chart" to "line" I was able to get my line chart!

To answer my second question, I found out that if I put all 5 search queries down stream of the pulldown, I can have 1 pulldown to rule them all.

I'm enjoying working with Sideview. I also think it's awesome that you (or yall) actively answer sideview questions. I'm quite impressed.

[sideview]

If the ValueSetter sample I posted doesnt' work for you, now I'm suspicious that you're running 1.3.5, which is a VERY old, even ancient version. Current release of Sideview Utils is 3.3.2, and you can see from release notes that the difference in performance and features and docs even, between the two versions is kind of immense. http://sideviewapps.com/apps/sideview-utils/release-notes/

but... maybe that's not the case. Have you taken a look at the docs and examples page for the ValueSetter module?

and while I've got you -- factor that autoRun="True" up much higher in the XML. You want generally one autoRun="true" up at the top, and definitely not deep in the hierarchy like this. And make sure there's only one - ie never nest an autoRun inside another one.

You're doing the right thing - playing around and discovering. Make sure you stitch in some time going to docs and examples pages for relevant modules. I am still sorry that the docs haven't been rewritten to be speaking to someone who went straight from Simple XML to Sideview XML. They still seem to be speaking to a person who has endured and suffered with the legacy advanced XML (these people don't really exist anymore). I'll get them rewritten sometime soonish.

[Splunkster45]

I just checked the version of Sideview Utils we have here at my company and it is 3.2.6. Maybe I just didn't understand the implementation. I've read the docs once and scanned it another time or two, but I must confess, I've stopped looking at the xml examples. The data referred to in the examples aren't on our servers and so all the graphs/charts/tables are broken. Without the visual examples the xml is more cryptic and so I glaze over it. I've gotten some good use from it though; it's just harder to figure out what does what and what is important to me. I bet I could get the full effect from it if I explored sideview-utils from home...

I think that as I'm figuring this out, the doc is going to get more useful and you're right, I need to go back to it more.

Based on your advice, I went back to sideview utils and added the Autorun=True as far upstream as I could. This happened to be in the one Pulldown module, (instead of 1 per search under the Pulldown module).

I would love to see a new version of the documentation! It probably (and understandably) won't come for a while, but I do look forward to it.

Thanks again!

[sideview]

Oh bummer - the data that all the examples use absolutely is on your system. However I think only admin-role users can see it, and possibly a well meaning admin may have even turned off the indexing of it. You can always install splunk on your laptop just to play with the working examples. The data they all use is splunk's own internal data so as soon as you install it, there will be data there. btw, post your XML somewhere and I'll probably spot the problem quickly.