Sideview Utils Gate and HiddenSavedSearch

[rgustafson]

Can the gate module be used downstream of a saved search? I'm getting the error message, "Configuration error - HiddenSavedSearch is being run as a schedule and is configured to listen to the time picker. Scheduled results will not be shown."

<module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" autoRun="true">
    <param name="savedSearch">Dash</param>
    <module name="ResultsValueSetter">
      <param name="fields">finished</param>  
      <module name="PostProcess">
        <param name="search">|eval running=if(isnull(finished) OR finished=0, 1, null)</param>
        <module name="ResultsValueSetter">
          <param name="fields">running</param>
          <module name="HTML">
            <param name="loadingText">--</param>
            <param name="html">
              &lt;h3&gt;Check&lt;/h3&gt;    
              &lt;p&gt;&lt;/p&gt;
                $running$ $finished$
            </param>
          </module>
            <module name="Gate">
              <param name="requiredKeys">finished</param>
              <param name="to">done</param>
            </module>
            <module name="Gate">
              <param name="requiredKeys">running</param>
              <param name="to">running</param>
            </module> 
        </module>
      </module>
    </module>
  </module>

[sideview · Accepted solution]

You can. However the error message doesn't have to do with the Gate module specifically.

What it's saying is that (presumably in the config you're Gating to), there is a TimeRangePicker and this creates a contradiction splunk doesn't know what to do with.

You've given it a HiddenSavedSearch and the default useHistory is "auto", and the savedsearch in question has a schedule. Therefore you're supposed to use the search results already run by the scheduler. But then it sees the TimeRangePicker down below and there you're telling the UI framework to throw away whatever timerange it already has and re-run the search over this timerange.

The Splunk UI sees this as a contradiction. And it has no idea the Gate modules are there, really.

If you can paste in the destination config of these Gate modules I might be able to help with what that TimeRangePicker is trying to do.

[sideview]

I was slightly wrong. This is actually the error that HiddenSavedSearch gives if it inherits a timerange from upstream. So I'm not sure what's giving it that idea. Is there a URLLoader module upstream and is there earliest= and latest= up in the URL?

You could just use the Sideview module. I dont think it treats this as an ambiguity - the savedsearch timerange just quietly clobbers whatever upstream timerange was set.

[rgustafson]

I do not have a timerangepicker module anywhere in the xml. I've attached the destination anyway.
Also, I do not have this problem using the sideview savedsearch module as opposed to hiddensavedsearch.