That is indeed puzzling. Can you email me the full XML? support [at] sideviewapps.com? And are there by any chance any javascript errors on the page? That's one thing that can cause baffling behavior - if something on the page is throwing a javascript error. Are there any other custom modules on the page, or anything custom in application.js? It might not be anything related to Sideview Utils at all. ... View more

You can implement this with some custom code in a customBehavior, using the customBehavior module. This is what the Sos app does with it's "Learn more" buttons. (As an aside I miss the olden days when that button text switched to "Learn less" when clicked. ) But customBehavior is kind of a last resort, and there's a couple ways to do this sort of thing without it. The best way is probably with a Switcher module. You would see a Switcher most commonly downstream from a Tabs module or a Pulldown module, and it would normally toggle which one of say 5 different "sets of modules" is active at any one time depending on the selected tab. But Switcher is a little more abstract than that. Switcher will have one or more sub-branches of child modules, and then at any one time depending on some $foo$ token coming from above, it will show zero or one of those child branches. So in the case where it's switching between showing zero or 1 child branches, it can be thought of a "VisibilityToggler" module too. The only ingredient missing to exactly match your requirement here, would be a sort of "ToggleLink" module, that had a link or button you could click, and whose label would toggle between "show instructions" and "hide instructions". However you can accomplish the same thing broadly speaking with a Checkbox module whose label says "show instructions". The whole thing is a little silly and abstract looking, but if you break down the simple tasks that the individual modules are doing, it's at least modular, and even better, it doesn't require reading, writing or understanding Javascript. <module name="Checkbox"> <param name="label">show instructions</param> <param name="name">showInstructions</param> <param name="onValue">yesPleaseShowInstructions</param> <module name="Switcher" group=" "> <param name="selectedGroup">$showInstructions$</param> <module name="HTML" group="yesPleaseShowInstructions"> <param name="html">Your instructions here</param> </module> </module> </module> ... View more

I'm afraid that I don't think there's a way to make Splunk's core "search" view always open in the Events tab. What the view uses to make the determination is the nature of the search itself. If the search is just a raw search or if it contains only streaming and non-transforming search commands, then the search will open in the events tab. On the other hand if it has a transforming command like "stats" or "timechart" or even a non-streaming command like "| table *", then it will open in the "Statistics" tab. What could be added to Sideview Utils, is a special key much like the special keys we already add, like $results.sid$ or $results.doneProgress$, that would be $results.eventSearch$. This could report the "eventSearch" property from the dispatched job. Splunk actually records the non-streaming transforming portion of the search into this property, and we could make it available for this kind of use case. In this case, instead of <param name="arg.q">search $search$</param> you would have <param name="arg.q">$results.eventSearch$</param> This would discard any commands like stats/timechart that are non-streaming commands and then the search would open in the events tab. Like the other $results.*$ keys, it would only be defined once the UI had actually received information back from the server, so for certain use cases where you need the information only moments after the search dispatches, it won't be there. ... View more

The work has not yet been done to make staticOptions support $foo$-substitution. It probably wont be able to happen for at least a month or two but I can bump it up a bit. In the meantime the workarounds are to use ValueSetter's with conditional logic. In your case this is only a partial workaround. You want to parametrize both the default value used downstream, and also the default label displayed in the selected option. But this workaround can only achieve the former. Note: I deleted some things from the <view> tag which shouldn't have been there, and I rolled up your two ValueSetters at the top into one using the arg.* syntax. And.... this is not a great workaround. It uses some very advanced and rarely-used functionality in ValueSetter, and absolutely staticOptions should support $foo$-substitution. That improvement will get implemented and sorry it has taken so long. <view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html"> <label>Home</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="SideviewUtils" layoutPanel="appHeader" /> <module name="URLLoader" layoutPanel="viewHeader" autoRun="True"> <module name="ValueSetter"> <param name="arg.defaultLabel">MyDefaultSite</param> <param name="arg.defaultValue">MDS</param> <module name="Search"> <param name="search">... | table Description, Abbr</param> <module name="Pulldown"> <param name="name">selectedWebsite</param> <param name="label">Web Site: </param> <param name="staticOptions"> <!-- Set default website to display when page loads --> <list> <param name="label">MyDefaultSite</param> <param name="value">DEFAULT_VALUE</param> </list> </param> <param name="labelField">Description</param> <param name="valueField">Abbr</param> <module name="ValueSetter"> <param name="name">selectedWebsite</param> <param name="if.$selectedWebsite$=DEFAULT_VALUE">$defaultValue$</param> ... View more

Certainly. With Sideview Utils basically all drilldowns to other pages are done with the Redirector module and the Redirector can specify any dynamic or static arguments to any dynamic or static URL. for example if you wanted to send the user to the pivot URL: pivot?earliest=0&q=| pivot internal_audit_logs searches count(searches) AS "Count of Searches" ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 you would use this Redirector config: <module name="Redirector"> <param name="url">pivot</param> <param name="arg.earliest">0</param> <param name="arg.q">| pivot internal_audit_logs searches count(searches) AS "Count of Searches" ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</param> </param> If you need to change the app then you would put an absolute URL into the URL like /app/search/pivot instead of pivot . If you want to incorporate any number of dynamic $foo$ tokens into either the target page, or any of the argument names, or any of the argument values, just include the $foo$ tokens inline. As to real world instructions, manually construct the pivot state you want to link to, then save that URL off somewhere save. Clip off the "accSID" argument and do not include that argument in the Redirector (pivot will actually work fine without it and generate the sid then-and-there). And parametrize the pieces you need into $foo$ tokens. ... View more

OK. It's hard to think of something that the Sideview UI modules could be doing that would require a higher set of capabilities than what the other UI systems require, but I certainly believe you. In that case yes I do think you've found a capability that cant really be removed or shouldn't really be removed. If you get a chance when you revisit this, go ahead and post or email me one of the views and the capability list. I'm interested in investigating a bit locally. ... View more

Certainly. Here is a simple self-contained example where there is a field called "showme" whose value is either "true" or "false". And the Button is embedded only inside hte Table rows that have showme="true". <module name="Search" layoutPanel="panel_row4_col2" autoRun="True" group="Buttons only show for some rows"> <param name="search"><![CDATA[ index=_internal source=*metrics.log group="per_sourcetype_thruput" | head 1000 | stats sum(kb) as totalKB by series | eval actions="PLACEHOLDER" | streamstats count | eval showme=if(count=="2","true","false") ]]></param> <module name="Pager"> <module name="Table"> <module name="ValueSetter" group="row.fields.actions"> <param name="name">foo</param> <param name="if.$row.fields.showme$=true">1</param> <module name="Gate"> <param name="requiredKeys">foo</param> <module name="Button"> <param name="allowAutoSubmit">False</param> <param name="customBehavior">confirmationPopup</param> <module name="Redirector"> <param name="popup">True</param> <param name="url">http://google.com</param> </module> </module> </module> </module> </module> </module> </module> You can of course use the Table module's "hiddenFields" to hide the actual rendered "showme" or "tobedeleted" column from the end user and it will still work. As to how/why this implementation works -- the ValueSetter module uses it's conditional logic to create a $foo$ token that will only be defined on certain rows. Then the Gate module will either block or allow the downstream push based on that token. Then last but not least the Button module happens to have a behavior where it wont render itself until the first push is received. If the Button didn't have that default behaviour then we'd have to cook up another way, possibly using the Sideview ShowHide module. ... View more

The SankeyChart module is a very early prototype I'm afraid, and there are quite horrible performance problems in it, such that it really hits a wall of death on relatively small datasets. It seemed clear to me that some significant amount of this problem was from the core code itself (that I borrowed from other open source examples), but I can't say for sure that my modifications are not also doing something dumb. =/ But yes. You're not crazy. possibly it's some fundamental limitation on the algorithm that it uses but I think there's a nasty piece of implementation in there that scales badly, and it's waiting for someone to find it and fix it. I'm very curious if you find any answers elsewhere. I have use cases for the SankeyChart module and this performance problem is far and away the largest problem blocking its general release as a part of Sideview Utils. ... View more

can you expand on "whenever the new role touches Sideview"? When they do what exactly? For example if this means "tries to use the Sideview Editor", that makes perfect sense and I can expand on that. If it means "navigates to a view using a Sideview module", then I'm stumped. ... View more

No no. hehe. the search-time extraction is fine. You just have to think a little differently about the base search. No matter what the base search is, you can construct it a little differently and you'll be fine. The docs page will explain all this. "Key Techniques - Using PostProcess - Introduction" ... View more

To clarify, are you asking a) whether a Table module in a dashboard built with Sideview Utils can have an "open in pivot" workflow? or b) whether the same Table module can have an "open in Sideview Report Builder" workflow. ... View more

You can have $foo$ tokens in the "url" param of the Redirector module. So if the values of the Pulldown options are themselves url's, then this is easily done. As to getting two levels of hierarchy into a single Pulldown. It can be done but it's often better to break these apart as two pulldowns floated alongside eachother. If you want to do it anyway, I think you can get the labels right just be fiddling with space chars and/or hyphens. As to how you get two values and two $foo$ tokens coming out at the end, there's a docs page in the Sideview Utils app itself dedicated to this topic. Navigate to Module Documentation > Form element modules > The Pulldown Module > Pulldown - setting more than one value. You basically pick a separator char, glue the 2+ values together on that separator, and then you use a single ValueSetter downstream. the ValueSetter's "delim" param will break apart the big token for you. ... View more

In order to not disrupt any other logic on the page, the best thing to do is to replace the two Pulldowns and their searches with a ValueSetter. More precisely, delete these lines: <module name="Search"> <param name="search">| splunkentity apps/local | table name</param> <module name="Pulldown" layoutPanel="mainSearchControls"> <param name="name">app</param> <param name="label">App:</param> <param name="valueField">name</param> <param name="staticOptions"></param> <module name="Search"> <param name="search">| splunkentity data/lookup-table-files app="$app$" | table name</param> <module name="Pulldown"> <param name="name">lookupName</param> <param name="label">Lookup Name:</param> <param name="valueField">name</param> <param name="staticOptions"></param> and replace them with this single ValueSetter module. <module name="ValueSetter"> <param name="arg.app">YOUR_APP_NAME_HERE</param> <param name="arg.lookupName">YOUR_LOOKUP_NAME_HERE</param> Another approach you might have tried (but that I think would have failed) is to go hardcode the tokens in the searches. However some customBehaviors are operating on this page, and those things will need the app and lookupName tokens to be there. ... View more

Oh that can be an even better way to go. Make sure you read or re-read the "Introduction to postProcess" page in the sideview docs because it saves you headaches from postprocess confusion in the long run. Splunk's postprocess mechanism is great but it has some common pitfalls. ... View more

No worries - I'll make a note to do that when the fix is posted. And... I can't really leave a boolean to do the old behavior cause the old implementation is really gone. The module used to do its bookkeeping around selections, when it really needed to do its bookkeeping by "deselections", which was the core of the problem. If you send me an email with full details (as full as you can), I can definitely think about it. nick [at] sideviewapps.com ... View more

Have you reviewed the pitfalls detailed in the PostProcess intro page in the Sideview docs? That's always my first stop when postprocess is involved. ie if the field isn't explicitly named in the base search and it's a search-time field extraction, you wont be able to filter on it in postprocess searches. ... View more

update - I came to understand the root cause here (the me making this prior comments had not yet understood). And it's being fixed as a bug. As soon as the next maintenance release goes out - CheckboxPulldown will be fixed, in that all options that it has never seen before will be checked. The buggy behavior prior was "it selects all by default, but only the first time it sees anything". Should be up in a day or two. I'll try and post back but I might forget. ... View more

Well the most common problem with low-privilege roles in Splunk is that they don't have the "rest_properties_get" capability. This means pretty much any request to splunkd will die (such users are little more than passive owners-of-objects). Can you post how you've broken down the capabilities? It might also be "rest_apps_view" or a couple other ones that might seem skippable but are not. ... View more

Can you give a little more detail? What does it say when it gives you error 500 (even it's just "Unknown Error")? Does it return a 500 when the user loads the page? or when users dispatch searches? Can you post the XML of the view? There are a number of 500 errors that boil down to something simple being accidentally omitted from the XML (and Splunk's framework having had some regressions over proper error state handling). ... View more

Update to the latest version http://sideviewapps.com/apps/sideview-utils/ the 1.X versions are ancient. In addition to a giant leap forward in features, performance and reliability, you'll get much much better documentation and working examples. ... View more

Can you clarify what version you have installed? You'll want the latest version from the sideviewapps.com website. If you're getting that Pager error, and that Table module error on the same page, then it almost certainly means you have a Sideview Utils app with no Table module, which means a pre-2.0 version (VERY old). ... View more

Or, if you're getting missing Table module, it can mean that you have a 1.X build installed. I'm puzzled by the "My admin has installed it version is 1.1", almost like the actual installed version is 1.1 but the docs being used are 3.X. ... View more