All Apps and Add-ons

Sideview Utils: Table hiddenFields param not substituting 'variables'

RaulMurillo
Engager

Hi,
I am using a Sideview Utils (2.2) Table module whose columns are only shown if selected by the user. Each column has an associated checkbox; if selected, the column is shown in the table. For that, the param hiddenFields comes in very handy. Unfortunately, it does not seem to work when I pass the value from the checkbox, as in the snippet below. The 'variable' $ColHost$ is not substituted by its actual value.

      < module name="Checkbox" layoutPanel="panel_row1_col1" >
      < param name="name">ColHost< /param >
      < param name="label">Host< /param >
      < param name="checked">True< /param >
      < param name="offValue">Host< /param >
      < param name="onValue">< /param>
      < module name="Search" layoutPanel="panel_row3_col1" autoRun="True">
         < param name="search">< ![CDATA[
                sourcetype=MRS_MESSAGES | search messageID NOT null |
                table Host Application   ... 
         ]]>< /param>
        < param name="earliest">-5h< /param>
        < param name="latest">now< /param>

        < module name="Pager" layoutPanel="panel_row3_col1">
          < module name="Table">
            < param name="hiddenFields">$ColHost$< /param>
            < param name="rowClass">$row.fields.Severity$< /param>
            ....

I have tried using the column name directly (Host) and that works correctly. But when I use $ColHost$, then the column is always shown, even when $ColHost$ holds the value Host.

sideview
SplunkTrust
SplunkTrust

It's just an oversight I'm afraid although an easy one to fix. I'll be able to put out a fix for this in the next version of Sideview Utils which is coincidentally releasing today or tomorrow latest.

Also, I noticed that the "fields" param doesn't allow $foo$ replacement either so I've fixed that as well.

As a possible workaround, know that if you have a "results.fields" key, that's the key the FieldPicker uses, and the table will listen to that. So although it's a positive list instead of an exclusion list, you could use a ValueSetter module or if you're comfortable with the weirder side of ResultsValueSetter, you could use a PostProcess and a ResultsValueSetter module.

Either way you could basically create a "results.fields" key upstream from the Table. The Table will always set it's field list to that key value if it sees it there.

0 Karma

sideview
SplunkTrust
SplunkTrust

Just to follow up - this was indeed fixed just a few days later. Specifically in 2.2.6 which released Nov 15th 2012. Latest version is 2.2.10 and release notes as always are here: http://sideviewapps.com/apps/sideview-utils/release-notes/

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...