The earlier code sample posted is a rough sketch of the sort of code to use. And the example posted later using customHeatMapDecorator will only work with SimpleResultsTable, NOT Table. In the next version of Sideview Utils you will be able to give your Table modules: <param name="columns.myFieldName.class">$myClassField$</param> <param name="hiddenFields">myClassField</param> and then the "myFieldName" column will get the value of the myClassField field as a class. You won't need any custom javascript at all. Can you wait a week or two? I can also email you a tar to use as a beta. ... View more

Yes, the custom JS solution here is tailored just for the SimpleResultsTable module. Sit tight and I will write back soon with an official answer to do this with Table and a customBehavior thereupon. Actually there is a whole feature to do this in Table coming, with no custom code, but that won't release until at least Sideview Utils 3.0 so pretend I didn't say anything. ... View more

Actually, the particular answer we're commentiog on here will not work. The HTML of the modules is not on the page when application.js is loaded, and to do any custom JS here properly you have to do more work that is missing from this code sample, to basically patch/insert yourself into the rendering logic of the module. ... View more

OK. And just for thoroughness, make sure to take it off the HiddenSearch as well. Leave only the one at the top on the TimeRangePicker, and in general leave only one total. I'll take another look though. Maybe there's a SingleValue bug happening. ... View more

I forgot to say - remember that ResultsValueSetter only ever gets fields from the first row, so therefore make sure your search is such that it will only ever have one row. That is a common pitfall when people are first using ResultsValueSetter. ... View more

Yep. At each pipe just picture a bunch of rows, each of which is just a set of key value pairs. A custom command can receive this and process it just like one of the core commands like "top" does. Also if you feel like you're not finding enough examples of custom python search commands in the docs, remember you can read the source any of the ones that ship - eg in the search app - "$SPLUNK_HOME/etc/apps/search/bin" ... View more

SplunkWeb only really looks on the filesystem for application.js when it's restarted. If there is one there when it restarts, it will try and serve it. If there was not one there when it restarted last, it will steadfastly ignore it. So I think just restart SplunkWeb and your code will start getting loaded. Also note that restarting just splunkweb ( splunk restart splunkweb ) will not cause anyone to lose auth. In fact the interruption in connectivity will be so brief that most users probably wont even notice it. ... View more

Sure. Just above your current Redirector, insert a Search and a ResultsValueSetter to make it look like this: Search ResultsValueSetter Redirector That Search will just quickly (well hopefully your search is quick) dispatch the search logic you need, and the ResultsValueSetter will pull down the one or more fields you tell it, so that they become $fieldName$ tokens in the UI. Then you can simply use those $fieldName$ tokens in your Redirector. As far as having a little logic around null values and defaults and what-have you, if you're already in search I find it easier to just use eval's up there. However ValueSetter has a lot of tricks and the ability to do simple conditional logic. As always the docs pages and embedded examples in Sideview Utils itself can illustrate each of these modules in better detail. http://sideviewapps.com/apps/sideview-utils By the way, if that little search takes more than a second or so you probably want to look into using a JobProgressIndicator module. Or this might be one of those few cases where the JobSpinner is a slightly better fit than JobProgressIndicator... . ... View more

There's a good chance this is simply "death by AutoRun". When you use autoRun="True" , you put one of them up at the top of the view, such that it's sufficiently high that if a push were to cascade down from there, it would touch all the points where you need searches dispatched. autoRun is not an attribute on any particular module - rather it is a flag to the overall module framework - "start pushing data down through all the modules, from HERE". What happens if you have more than autoRun="true" is you have a peculiar little race. Sometimes it may work, or sometimes you'll end up with a bunch of modules "seeming to not react to upstream changes properly". What happens if you have TONS of autoRun="True" is that things just get more and more evil. I would definitely start with that - take away every one of them except the one on the very topmost HiddenSavedSearch. And do not put autoRun="False" because this is meaningless and it will only confuse you or some other human later. If removing the extra autoRun's doesn't fix it then leave a comment and I will update this answer. UPDATE: I'm afraid I don't know what's wrong. I've duplicated your view except for changing it to run against index=_internal data, and when I remove the autoRun's it works fine for me. =/ Maybe you can take this XML below and run it on your system and find the difference. <module name="TimeRangePicker" layoutPanel="panel_row1_col1" autoRun="True"> <param name="default">Last 24 hours</param> <param name="searchWhenChanged">True</param> <module name="HiddenSearch" layoutPanel="panel_row2_col1"> <param name="search">index=_internal source=*metrics.log group=per_sourcetype_thruput | stats max(eps) as maxEps sum(kb) as sumKb</param> <module name="JobProgressIndicator"/> <module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp1" group="Session Stats" > <param name="search"> | eval range="remote" </param> <module name="SingleValue"> <param name="field">maxEps</param> <param name="classField">range</param> <param name="afterLabel">max eps</param> <param name="format">count</param> </module> </module> <module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp2" group="Session Stats" > <param name="search"> | eval range="user" </param> <module name="SingleValue"> <param name="field">sumKb</param> <param name="classField">range</param> <param name="afterLabel">total KB</param> <param name="format">count</param> </module> </module> </module> </module> ... View more

Ayn's answer is better - my answer is overkill. I thought you needed to get details about the timerange, downa s information in the dollar-token space (ie $foo$) in the module system.... On second read it sounds like you just need addinfo. ... View more