Hm. I think I understand. But if you use the grp1, grp2 and grp3 layoutPanels, they are basically designed to split the available width. ie if you have three they will each be 33% width etc.. If that's unwanted it may make more sense to leave them in the same layoutPanel but then use CSS to arrange them with float and margin styles? eg: this would line the HTML modules up left to right, but without splitting the full width. .splView-pingstatus .panel_row1_col .HTML { float:left; margin-left:20px; } I'm assuming here that your view is called "pingstatus" ... View more

And just a beat a dead horse - you went to the bump URL and also clicked the "bump" button there, right? Sorry to make you answer again! If the answer is yes, then email me at nick [at] sideviewapps.com and lets jump on a webex. I'll be able to figure out quickly where the old code is hiding. ... View more

I'm sorry. The detail you added helps, but it looks like such an unusual problem that I would contact Splunk Support. Sounds like a bug. As to the "before X" weirdness - since I wrote my answer I've seen that myself on scheduled searches. I think it represents some cosmetic bug in Splunk where scheduled search results no longer report their timerange properly to the Splunk UI. But how it's possible for a search that essentially ends with a stats count , to ever return zero results - that one I have no idea about. Hopefully Splunk Support does. Good luck. ... View more

You just need to remove the <param name="valueField">timeframe</param> param from the second Pulldown. The valueField param is what tell the Pulldown to render dynamic values. So it is looking into the current search results it has, which are of course the same results as it's upstream Pulldown had, and it's looking for a field called "timeframe". There isn't one presumably, so it renders a lot of "(no value found)". just delete that param and you'll be good to go. ... View more

Well normally the app navigation menu gets the label from the <label> node which is generally sitting at the top level of the view, just under the <view> tag. If converting your view to HTML means using someting like the Sideview HTML module to embed lots of HTML, there will still be a <label> node to edit. And if there isn't one just add one. On the other hand if "converting your view to HTML" means something fancier or involving the new Splunk 6 framework, there's probably some other official way of specifying what the view label should be. ... View more

If writing and maintaining a lot of Javascript and CSS code isn't your cup of tea, then you can take a look at the Table module in Sideview Utils. If you have a relatively recent version of the Sideview Utils app you can do this fairly easily and without any custom javascript or CSS. It'll only require a few extra lines in the XML itself. The Table module has a feature called Table Embedding where you can embed other UI modules into individual tablecells. The most common use of this by far is to embed a Sideview HTML module. And here you can easily embed an HTML module into each of the cells in that column, and have those tablecells display an icon. And of course the HTML can incorporate dynamic field values so the icon can vary depending on the data in the given row. The Sideview Utils app itself has a lot of docs and examples contained inside, and it has a whole page of docs and working examples just on the Table Embedding feature. Moreover, hidden inside the app is a much longer view called "testcases_for_table_embedding". Although this is an internal view used for our regression testing, it does ship and it does have an example specifically where little icons get embedded into a column of a table. Here I've lifted out the entire XML for that example so you can see it, and so you can see that it really involves no custom javascript or CSS. (OK I cleaned it up very slightly. 😃 <module name="Search"> <param name="search"><![CDATA[ * | head 1000 | timechart count | delta count as change | search change=* change!="0" | eval rises=if(change>0,"sort_asc",if(change<0,"sort_desc","none")) ]]></param> <module name="Table"> <module name="HTML" group="row.fields.rises"> <param name="html"><![CDATA[ <img src="/static/app/sideview_utils/images/arrow_$row.fields.rises$.gif"> ]]></param> </module> </module> </module> Next steps if you're interested: -- Download the latest Sideview Utils app (3.1) from the Sideview website. It is free for internal use. http://sideviewapps.com/apps/sideview-utils You can only get the latest app from Sideview. Don't look on Splunkbase because Splunkbase only has an ancient LGPL version. -- Make sure to read the first couple pages of overview documentation. They will orient you and give you a good general grounding. Sideview Utils allows you to stop using almost all of the core advanced XML modules but you need those first few pages to unlearn and learn conventions and concepts as appropriate. -- Read the full docs for the Table module, including the Table Embedding docs. Incidentally you could also do this with the "Table Rendering" feature of the Table module, which is a different feature that allows you to give any rows and any columns (and thus any cells) dynamic CSS classes where the class string incorporates one or more field values. With this and a little CSS you could very easily make icons appear in the given cells. However on the whole I recommend Table Embedding cause it's a lot less finicky and it involves zero custom JS or CSS. If you want to read more about the history you can read the release notes - http://sideviewapps.com/apps/sideview-utils/release-notes/ (Table was released back in version 2.2 in October 2012.) and if you are curious about the "free internal use" licensing you can read the licensing FAQ - http://sideviewapps.com/apps/sideview-utils/licensing-faq/ ... View more

Yes. I switched over as soon as possible and it's a lot better. I wish there was still some way for it to index the header lines, because the header "events" can be quite useful from the app layer. And it didn't actually work on 6.0 for some of my sourcetypes (fixed in 6.0.1), but it has been a vast vast improvement. ... View more

You tagged the question sideview, but you're not using any of the Sideview modules that would make this easier. Are you open to an answer that uses Sideview modules? ... View more

That is strange. I think you're having more than one problem here. 1) timerange. If you look in Manager what timerange does Manager think the scheduled saved search has? Is it possible there's a typo on the earliest side? If the scheduled results are saying "before X", then that means it was run with no earliest time bound.. 2) Can you post the XML of the dashboard? Is it possible that there's a postprocess search hidden in there, or a forgotten dropdown that adds a searchterm via an intention or something? You are absolutely correct - no matter what happens before the | stats count as lista , the stats command will always output its single row. And rangemap will always take that row and add a range field, and give back one row. So the overall search result should always have one row, not zero rows... We're missing some piece of the puzzle here. 3) Separately, but also problematic, your dedup command is causing harm or at least not doing what you think it's doing. | dedup cloud_info,cloud_hostname is going to go through the set of results it's given, and for each combination of cloud_info and cloud_hostname it sees, it is going to keep only the first such row it sees and throw away the rest. What values that row has for cloud_status is anybody's guess.. If for a given combination of cloud_info and cloud_hostname, the latest event happens to have cloud_status="Error", then it might match. If the "Error" rows are among the rows that get thrown away by dedup, you're outta luck. I would just remove that dedup, or possibly reduce it to dedup cloud_info cloud_hostname cloud_status ... View more

Downright peculiar! OK it'll be something fun. To double check, by "uninstalled" do you mean you deleted the app from the filesystem? And are you installing through the Splunk UI or by manually untarring and putting it into $SPLUNK_HOME/etc/apps? (Obviously either should work but the answers are interesting.) eg: sometimes permission changes from weird edits or unsolved mysteries have caused a couple old files to linger across an app upgrade. And sometimes "disabling" an app is misinterpreted as removal. Would you be willing to do a quick webex? It'll reach some answer pretty quickly. ... View more

Is it possible that there's a single line event written into the logs that is extraordinarily long? I recently found that single line events with tens of thousands or hundreds of thousands of characters can hang the browser. ... View more

OK. I can give you a couple directions. 1) I suspect that talk of visualization is an order of magnitude too sexy compared to what's actually needed here. This sounds like a use case where you really just need search language to massage the information about a given transaction, into a form where each service is a row. 1b) If that eventual result set is too ungainly to fit into one giant Table, or if it needs a touch of HTML formatting to make it palatable, you can use the "Embedding" feature of the Table module to embed any module config inside certain tablecells. The Sideview utils docs have examples of how to do this and it's very powerful. For example you could get a Table with N rows - one for each service, and each row has a cell with a little chart, and another cell with a header and some little fields printed out in plain text. All this can be interactive so those charts can all have drilldowns etc, and you can have other form elements in there, and you can do inline drilldowns. Granted, what people usually embed is just an HTML module. 😉 2) In general when you want to show a table or a chart or an HTML block about some entity X, but you don't know how many X's there will be on the page, but you dont want to doom the stuff to living inside a Table via "table embedding" (see above), then this is a case for the Sideview Multiplexer module. You can "multiplex" any module config. 2b) If I were allowed to go a little crazy on these requirements, and assuming you have some kind of 'transaction id' field, I'd make a list view that lists a table of the transactions, use the Sideview Table module to hide the transaction id as one of the fields. use that field on a drilldown to a 'transaction_detail' view. Use the Multiplexer module on that detail view to multiplex say a search and a chart and a bit of HTML, per service involved. The multiplexer stuff is very advanced Sideview Utils stuff. My main disclaimer is that it may not be your cup of tea. The XML isn't very long but the whole idea of "multiplexing" other modules will make your head hurt. 3) The first thing that came to mind is more a source of inspiration and that's a hidden view in the Splunk on Splunk app called "masaaki_diagram_prototype". You wont find this view in the navigation menus but you can manually go to it by going to http://YOUR_SPLUNK_HOST:8000/en-US/app/sos/masaaki_diagram_prototype The implementation is desperately unsexy, but quite quick and simple to put together, for what it gives the end user. In other words it's within reach of mere mortals. I threw it together for the SoS team long ago as a quick example. Basically it embeds a huge gif of a flow chart, where some of the circles have had their backgrounds knocked out to be transparent. Then an HTML module uses CSS to position a couple big layers behind those knocked-out-areas. Then some search language and a ResultsValueSetter conspire to turn the current index queue sizes into colors from green to red. The net effect is that the big flow chart diagram gets colors painted into it, and the colors represent the size of the given indexing queue. download SoS if you don't have it already and crack open etc/apps/sos/default/data/ui/masaaki_diagram_prototype.xml ... View more

As to making the escaping configurable, I've thought about that a lot but it seems like a "worst-practice" direction for the framework that'll create a lot of tangled use cases with just as much surface area for bugs. or at least just as much surface area for "sideview support cases". I'm still trying to prevent 99% of developers from thinking about this stuff at all. And as a last resort there's always a customBehavior! ... View more

Yep. backslashes in Sideview params are generally treated as literal backslash characters in the content, so as such they always get escaped in anything that is destined for the search language, like the main $myNameParam$ tokens. Note however there's always a $myNameParam.rawValue$ token that is to be used for url's, HTML displayed to the user and redirector arguments, and in there you dont get escaped backslashes.. ... View more

Sorry I just assumed you'd use the timeRangePicker to set the timerange to "last 30 days". You can have more fine grained control using the advanced modes of the TimeRangePicker too. ... View more

Gotcha. So to restate you want to take all the hourly averages going back 30 days and then get the 90th percentile of them. And the average duration from the last hour has to come along for the ride. I think we're there. Or almost. 😃 How about this. index=tt Reserve OrderIntegration | transaction dye maxspan=30s maxpause=10s startswith="Begin Reserve" endswith="End Reserve" | eval lastHourDuration=if(_time>relative_time(_time,"-1h"),duration,null()) | bin _time span=1h | eventstats avg(duration) as avgDuration by _time | stats perc90(avgDuration) avg(lastHourDuration) ... View more

This is a very longstanding bug with the Sideview form element modules, around double-quote handling. Very few have run into it, and in the past, in the cases I've seen at least, we've been able to find other workarounds. I believe after some fresh thinking this morning that I have a fix for it and I am beginning to put that fix through its paces. The fix only changes a few lines of code, fixes the issue across not just Checkboxes but also Pulldown, Radio, Tabs and ArrayValueSetter, and I don't think it has any side effects. However my paranoia level is very high about it because the set of all use cases for all these modules is a big set and I can't cause any regressions. Thus I need to write a lot more testcases and let it burn in with some of our apps for a while before I'll release it. Some background. The history of search-language escaping in general in Splunk UI modules is a pretty messy one. The Sideview modules have improved things greatly over the last 3 years, but at considerable investment of time and energy. Even so gaps remain, both known and unknown. The gaps have at least steadily closed over the years, and bugs have been fixed rapidly once reported publicly. You can actually search through the Sideview Utils release notes and see for yourself that there have been a steady diet of improvements around escaping behavior. http://sideviewapps.com/apps/sideview-utils/release-notes/ It at first seems like form element modules should always automatically escape their selected values to "work" in the search language, but the truth is a lot messier. For instance Textfield and Table drilldowns are very commonly used to generate $foo$ tokens that are already complete search expressions for direct substitution. Such expressions need to back backslash-escaped but doing any further escaping on these values is a disaster. Yet still we must automatically escape dynamic options in our Pulldowns, allow things to be templatized into quoted expressions, and in the middle find somewhere to draw what seem like so many lines in the sand. (Things are far far better now than they were in the early days, and the lines have sensible use cases and comments and contracts etc. 😃 HOWEVER. The larger trickier big picture is beside the point. The problem you have found here can be defined very narrowly - concerning only Sideview modules that have "template" params, where the user is templating the selected value inside the template. In these modules the problem is well defined and a well defined contract can be made - when the module "templatizes" the value, it can look at the template, check whether the value is going inside a quoted expression in the template string. If so, it escapes quote chars in the templated value. So... that's the change I want to put in, and since at this point 3.0.2 is looking to have a lot of improvements in it already, it'll be 3.1, out in a week or two. Thank you VERY much for writing this up and helping me get a fresh look on a very well-worn topic. ... View more

Well you can always sneak a style block in with an HTML module as a last resort. <module name="HTML" layoutPanel="viewHeader"> <param name="html"><![CDATA[ <style type="text/css"> .mainSearchControls .TimeRangePicker { float:left; } </style> ]]></param> </module> ... View more