Dashboards & Visualizations

Multiple forms with an Input Field and TimeRangePicker - No Repeat Input

beaumaris
Communicator

I have a dashboard with several panels each having an input field, TimeRangePicker, and a search button. After input and when the search completes, the graph is generated but the 'view_result' link does not show and the vertical size bar is partially hidden behind the panel. More importantly, I am unable to enter data or search again on that panel. Attached is the Advanced XML for the panel.

I may have an ordering problem but if I move the input controls to be under the HiddenSearch, I get a 'no child module' error. Is there a better way to organize this panel?

<!-- PANEL #1 -->
<module name="GenericHeader" layoutPanel="panel_row1_col1">
  <param name="label">Frequency of Visitor Return</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="search">| noop</param>
  <module name="ExtendedFieldSearch">
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="client_ip">
          <param name="default"></param>
          <param name="fillOnEmpty">True</param>
          <param name="value">$target$</param>
         </param>
      </param>
    </param>
    <param name="replacementMap">
      <param name="arg">
        <param name="client_ip">
          <param name="value"></param>
        </param>
      </param>
    </param>
    <param name="field">Client IP Address</param>

    <!-- The Time Range dropdown definition -->
    <module name="TimeRangePicker">
      <param name="searchWhenChanged">True</param>
      <module name="SubmitButton">
        <param name="allowSoftSubmit">True</param>
        <param name="label">Search</param>

        <module name="HiddenSearch" layoutPanel="panel_row1_col1">
          <param name="search">`Frequency_of_Visitor_Return($client_ip$)`</param>
          <module name="ViewstateAdapter">
            <module name="HiddenFieldPicker">
              <param name="strictMode">True</param>
              <module name="JobProgressIndicator">
                <module name="EnablePreview">
                  <param name="enable">True</param>
                  <param name="display">False</param>
                  <module name="HiddenChartFormatter">
                    <param name="charting.primaryAxisTitle.text">Date/Time</param>
                    <param name="charting.secondaryAxisTitle.text">Count</param>
                    <param name="charting.legend.placement">none</param>
                    <param name="charting.chart">column</param>
                    <module name="FlashChart">
                      <param name="width">100%</param>
                      <module name="ConvertToDrilldownSearch">
                        <module name="ViewRedirector">
                          <param name="viewTarget">flashtimeline</param>
                        </module>
                      </module>
                    </module>
                    <module name="ViewRedirectorLink">
                      <param name="viewTarget">flashtimeline</param>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

sideview
SplunkTrust
SplunkTrust

If the ViewRedirectorLink module is not showing, and the resize bar on the FlashChart is getting displayed in a wonky fashion, I'd look for any custom CSS. It sounds like something in application.css is messing with floats.

as far as the XML, there is some redundant XML in here, but nothing that I can see that would cause the ViewRedirectorLink to render weird or behind the chart.

some of the extra XML is vestigial from when the view was converted from the Simplified XML to the advanced XML. The Simplified XML has some bugs where it does some weird things and these come out later when it gets converted to the underlying format:

  • JobProgressIndicator doesnt need to nest any modules inside it, in fact this is meaningless.
  • EnablePreview doesnt need to nest any modules inside it either (also meaningless).
    It just needs to be living down at or below the level where the search will get kicked off.
  • HiddenFieldPicker and ViewStateAdapter are meaningless in your case.

So I fixed those for you. In addition you had one other piece of extra XML:

-- you had a HiddenSearch at the top with a 'noop' search in it. This wasnt doing anything so I removed it.

<!-- PANEL #1 -->
<module name="GenericHeader" layoutPanel="panel_row1_col1">
  <param name="label">Frequency of Visitor Return</param>
</module>
<module name="ExtendedFieldSearch" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="field">Client IP Address</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="client_ip">
        <param name="default"></param>
        <param name="fillOnEmpty">True</param>
        <param name="value">$target$</param>
       </param>
    </param>
  </param>
  <param name="replacementMap">
    <param name="arg">
      <param name="client_ip">
        <param name="value"></param>
      </param>
    </param>
  </param>

  <!-- The Time Range dropdown definition -->
  <module name="TimeRangePicker">
    <param name="searchWhenChanged">True</param>
    <module name="SubmitButton">
      <param name="allowSoftSubmit">True</param>
      <param name="label">Search</param>

      <module name="HiddenSearch" layoutPanel="panel_row1_col1">
        <param name="search">`Frequency_of_Visitor_Return($client_ip$)`</param>
          <module name="JobProgressIndicator"></module>
          <module name="EnablePreview">
            <param name="enable">True</param>
            <param name="display">False</param>
          </module>

          <module name="HiddenChartFormatter">
            <param name="charting.primaryAxisTitle.text">Date/Time</param>
            <param name="charting.secondaryAxisTitle.text">Count</param>
            <param name="charting.legend.placement">none</param>
            <param name="charting.chart">column</param>
            <module name="FlashChart">
              <param name="width">100%</param>
              <module name="ConvertToDrilldownSearch">
                <module name="ViewRedirector">
                  <param name="viewTarget">flashtimeline</param>
                </module>
              </module>
            </module>
            <module name="ViewRedirectorLink">
              <param name="viewTarget">flashtimeline</param>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...