All Apps and Add-ons

Searches re-running when an alternative down stream pulldown option is selected

Lucas_K
Motivator

I have a dashboard with 2 down stream pulldown modules that users can use to modify the chart display in different ways (line/area/column + stacked/none/100% etc).

When one of these options is selected the search is re-run. For a split second the display actually switches and you can see the selected display option in the chart.

Now my question is, as the pull downs are downstream of the base search shouldn't the normal behaviour be that it doesn't trigger the search to run again or is this correct behaviour?

Splunk v6.0.2
Sideviewutils v3.1

I'm basically trying to not have the search run again just to have it displayed differently.

Example code (this is actually a modified sos indexing dashboard 😉 😞

    <module name="Search" autoRun="False">
                                            <param name="search">`set_internal_index` $host$ $hostedgroup$ source="*metrics.log" group=per_$type$_thruput  | rex field=host "(?P&lt;short_host&gt;.+).com" | eval series=series."_".short_host | timechart minspan=30s $span$ per_second(kb) by $series$ useother=false limit=15</param>


                                    <module name="Pulldown" layoutPanel="panel_row1_col1" group="Estimated indexing rate">
                                        <param name="clear">right</param>
                                        <param name="name">charting.chart</param>
                                        <param name="float">right</param>
                                        <param name="staticOptions">
                                            <list>
                                                <param name="selected">true</param>
                                                <param name="label">Column</param>
                                                <param name="value">column</param>
                                            </list>
                                            <list>
                                                <param name="label">Line</param>
                                                <param name="value">line</param>
                                            </list>
                                            <list>
                                                <param name="label">Area</param>
                                                <param name="value">area</param>
                                            </list>
                                            <list>
                                                <param name="label">Bar</param>
                                                <param name="value">bar</param>
                                            </list>
                                        </param>

                                <module name="Pulldown" layoutPanel="panel_row1_col1" group="Estimated indexing rate">
                                    <param name="customBehavior">stackModePulldownForChartView</param>
                                    <param name="name">charting.chart.stackMode</param>
                                    <param name="float">right</param>
                                    <param name="label">Stack mode</param>
                                    <param name="staticOptions">
                                        <list>
                                            <param name="selected">true</param>
                                            <param name="label">Stacked</param>
                                            <param name="value">stacked</param>
                                        </list>
                                        <list>
                                            <param name="label">None</param>
                                            <param name="value">default</param>
                                        </list>
                                        <list>
                                            <param name="label">100% Stacked</param>
                                            <param name="value">stacked100</param>
                                        </list>
                                    </param>


                                            <module name="LinkSwitcher">
                                                <param name="mode">independent</param>
                                                <param name="label">Show as:</param>
                                                <module name="HiddenChartFormatter" group="Graph">


                                                    <param name="charting.legend.placement">right</param>
                                                    <param name="primaryAxisTitle.text">Time</param>
                                                    <param name="secondaryAxisTitle.text">Indexing rate (KB/s)</param>
                                                    <module name="JobProgressIndicator"/>
                                                    <module name="FlashChart"/>
                                                </module>
                                                <module name="Paginator" group="Table">
                                                    <param name="entityName">results</param>
                                                    <module name="HiddenPostProcess">
                                                        <param name="search">addtotals</param>
                                                        <module name="SimpleResultsTable"/>
                                                    </module>
                                                    <module name="Paginator">
                                                        <param name="entityName">results</param>
                                                    </module>
                                                </module>
                                            </module>
                                            <module name="ViewRedirectorLink">
                                                <param name="viewTarget">flashtimeline</param>
                                                <param name="popup">true</param>
                                            </module>
                                        </module>
                                    </module>
                                </module>

                            </module>
                        </module>
0 Karma

sideview
SplunkTrust
SplunkTrust

No problem. It's easily done.

What you want to do is go back to the docs page "Key Techniques > Overview of the Advanced XML". It basically tells you the two Very Unintuitive things about the Splunk UI framework. Once you've read that page and understood it, you'll see what's happening with your XML for yourself.

Or from the homepage you can click the big "On to the Examples!" link that you see in the top right. (The link technically lies - before you can succeed the examples you have to read that one docs page.)

So anyway, I can also paraphrase what's happening here. Modules like the Search module do not dispatch searches. Instead the framework uses its own rules to figure out "where" in the hierarchy the dispatched search is needed. According to those rules, spelled out on in full detail on that Sideview docs page, the search isn't actually dispatched until below your two Pulldowns. Basically the first module it sees that needs a dispatched search is one of the Paginators, way deep in your config.

The solution is to change that determination. The easiest way is to move a JobProgressIndicator module or some other "dispatching module" up to be at the same level as your two Pulldowns.

ie

Search
  JobProgressIndicator
  Pulldown
    Pulldown
      LinkSwitcher
         ...etc...

That little change will result in what you want. And if the JobProgressIndicator isn't showing up where you want it, you can usually finagle layoutPanel attributes a little bit (modules dont know and dont care where they are on the page). If that doesn't work let me know. There are a couple other ways.

And most of all, read that docs page. It's long but it'll turn on a couple little lights over your head.

inside Sideview Utils itself, "Key Techniques > An Overview of the Advanced XML"

0 Karma

Lucas_K
Motivator

Thanks.

I'd played with rearranging module order previously and I just couldn't figure out which one was the trigger.

So basically the crux of it is know what data each module requires. If it needs data from a search a dispatch will automatically be performed.

"Picture a particular module and ask yourself if it can do its job meaningfully without some search results to access. If the module cannot, then you can assume that it is a "dispatching module"."

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...