All Apps and Add-ons

Sideview utils pulldown stopped working after upgrading to Splunk 5

tsmithsplunk
Path Finder

After the Splunk 5 upgrade, a dashboard using a Pulldown module malfunctioned. I'm using Sideview Utils 1.3.5. The specific error msg is "ERROR - Pulldown is configured statically but with only a single static option."

I also get various errors when saving the view:
"Misconfigured view 'uit_usage' - Unknown parameter 'valueField' is defined for module Pulldown. Make sure the parameter is specified in Pulldown.conf."

"Misconfigured view 'uit_usage' - Unknown parameter 'staticOptions' is defined for module Pulldown. Make sure the parameter is specified in Pulldown.conf"

Perhaps Sideview utils needs to be reinstalled?

here's the view xml:

<?xml version='1.0' encoding='utf-8'?>





<module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
</module>

<module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
</module>

<module name="SavedSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="name">UIT Usage</param>

    <module name="HTML">

        <param name="html"><![CDATA[
                      <div style="font-weight:bold; font-size:1.2em">Top 30 Orgs by usage over the last 7 days</div>
        ]]></param>
                <!--
                <param name="html"><![CDATA[
                      <div style="font-weight:bold; font-size:1.2em">Top 30 Orgs by usage during the 13.2 UIT period</div>
        ]]></param>
                -->
    </module>

    <module name="Pulldown">
        <param name="name">orgList</param>
        <param name="label">See daily counts by choosing an Org below or from this option list</param>
        <param name="postProcess">dedup applog_orgName | sort applog_orgName</param>
        <param name="valueField">applog_orgName</param>
        <param name="staticOptions"></param>

        <module name="PostProcess" layoutPanel="panel_row1_col1_grp1">
            <param name="search">chart count over applog_orgName | sort 30 count desc</param>

            <module name="HiddenChartFormatter">
                <param name="charting.axisTitleY.text">Organization</param>
                <param name="charting.legend.placement">none</param>
                <param name="charting.chart">bar</param>
                <param name="charting.axisTitleX.text">Number of Commands</param>

                <module name="FlashChart">
                    <param name="width">100%</param>
                    <param name="height">500px</param>

                    <!-- changing the drill down to show daily counts for the selected org -->
                    <module name="PostProcess" layoutPanel="panel_row2_col1">
                        <param name="search">where applog_orgName="$click.value$" | timechart count by applog_orgName span=1h</param>

                        <module name="SimpleResultsHeader">
                            <param name="entityName">results</param>
                            <param name="headerFormat">Daily usage for $click.value$</param>
                        </module>

                        <module name="HiddenChartFormatter">
                            <param name="charting.axisTitleY.text">Commands</param>
                            <param name="charting.legend.placement">none</param>
                            <param name="charting.chart">column</param>
                            <param name="charting.axisTitleX.text">Day</param>

                            <module name="FlashChart">
                                <param name="width">100%</param>
                                <param name="height">200px</param>
                            </module>
                        </module>
                    </module>

                </module>
            </module>
        </module>

        <module name="PostProcess" layoutPanel="panel_row2_col2">
            <param name="search">where applog_orgName="$orgList$" | timechart count by applog_orgName span=1h</param>

            <module name="SimpleResultsHeader">
                <param name="entityName">results</param>
                <param name="headerFormat">Daily usage for $orgList$</param>
            </module>

            <module name="HiddenChartFormatter">
                <param name="charting.axisTitleY.text">Commands</param>
                <param name="charting.legend.placement">none</param>
                <param name="charting.chart">column</param>
                <param name="charting.axisTitleX.text">Day</param>

                <module name="FlashChart">
                    <param name="width">100%</param>
                    <param name="height">200px</param>
                </module>
            </module>
        </module>

    </module>   
</module>

1 Solution

sideview
SplunkTrust
SplunkTrust

Well your view is using params that only exist in Sideview Utils 2.X, so clearly that app has a dependency on Sideview Utils 2.X, and not 1.3.5.

I'm thinking that in your upgrade to Splunk 5, you inadvertently reverted from a recent Sideview Utils to the very old 1.3.5 version?

http://sideviewapps.com/apps/sideview-utils

and if you want to read the release notes you can see valueField and staticOptions in there:
http://sideviewapps.com/apps/sideview-utils/release-notes/

and remember to get on the mailing list so you can get a litlte email when there are new releases.
http://sideviewapps.com/apps/sideview-utils/mailing-list/

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

Well your view is using params that only exist in Sideview Utils 2.X, so clearly that app has a dependency on Sideview Utils 2.X, and not 1.3.5.

I'm thinking that in your upgrade to Splunk 5, you inadvertently reverted from a recent Sideview Utils to the very old 1.3.5 version?

http://sideviewapps.com/apps/sideview-utils

and if you want to read the release notes you can see valueField and staticOptions in there:
http://sideviewapps.com/apps/sideview-utils/release-notes/

and remember to get on the mailing list so you can get a litlte email when there are new releases.
http://sideviewapps.com/apps/sideview-utils/mailing-list/

0 Karma

tsmithsplunk
Path Finder

That must be it. I looked back in my notes from a year ago when sideview utils was first installed and I had v2.2.2. I have no idea how 1.3.5 got installed. I have informed IT and I'm sure once the new version gets installed things will start working. Many thanks!

0 Karma

tsmithsplunk
Path Finder

Does anyone know if the sideview utils Pulldown module can use a saved search? I've been tinkering with this and it appears like the Pulldown is not recognizing the upstream SavedSearch.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...