All Apps and Add-ons

Nested SideView modules don't show up until drilldown click is performed

steverazor
Explorer

I have a view that I created using Sideview Utils 3.2.6 and AdvancedXML in Splunk 6.1.1. My desire is to have two charts display next to each other with a "Top Level" timepicker above everything and a timepicker for each chart. One chart (Mid Level) that shows counts by month for 12 months and one chart (Bottom Level) that shows counts by day for 1 month. I would like to have both charts drawn when the page loads with the values that are determined with if.* logic based off of the top level timepicker and I would ALSO like to have the second chart be updated when a drilldown click is performed on the first chart.

As it stands now, the second chart is hidden until a drilldown click is performed on the first chart. I need a way for the modules nested below the JSChart to show up when the page loads and not wait for a drilldown click to display, but also be passed the $click.value$ when a drilldown click is performed on the first chart.

Below is the XML that I am using. I am currently just trying to show that the $click.value$ parameter gets passed downstream to the last HTML module. My end goal is to have the bottom level timepicker use the $click.value$ parameter to set the timerange for the nested search, but I can't even to get the page to display properly when loaded, so any help is much appreciated!


<view isSticky="False" isVisible="true" onunloadCancelJobs="true" template="dashboard.html">
  <label>TimePicker Sideview Test 1 Drilldown Fail</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="appHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>
  <module name="HTML" layoutPanel="viewHeader">
    <param name="html">
      <![CDATA[
        <h1>TimePicker Sideview Demo</h1>]]>
    </param>
  </module>
  <module name="TimeRangePicker" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="label">Top Level</param>
    <param name="default">Last 12 months</param>
    <module name="ValueSetter">
      <param name="arg.stashedEarliest1">$search.timeRange.earliest$</param>
      <param name="arg.stashedLatest1">$search.timeRange.latest$</param>
      <param name="arg.charting.chart.stackMode">stacked</param>
      <module name="TimeRangePicker" layoutPanel="panel_row2_col1">
        <param name="default">Last 12 months</param>
        <param name="label">Mid Level</param>
        <module name="Search">
          <param name="search">
            <![CDATA[
            index=myidx1 sourcetype=mystats | eval Day=strftime(_time,"%d") |eval Month=strftime(_time,"%Y-%m") | eval Process_Time=(time_end-time_start) | rangemap field=Process_Time >_20_seconds=20-9999999999 20_seconds=11-20 10_seconds=6-10 default=5_seconds | chart count over Month by range | fields _* * >_20_seconds 20_seconds 10_seconds 5_seconds | rename >_20_seconds as ">20 Seconds" 20_seconds as "<= 20 Seconds" 10_seconds as "<=10 Seconds" 5_seconds as "<=5 Seconds"
            ]]>
          </param>
          <module name="HTML">
            <param name="html">
              <![CDATA[
stashedEarliest1 - stashedLatest1
<br>
$stashedEarliest1$ - $stashedLatest1$
<br>
<br>
search.timeRange.latest:  $search.timeRange.latest$
<br/>
search.timeRange.earliest:  $search.timeRange.earliest$
<br/>
]]>
            </param>
            <module name="JSChart">
              <module name="ValueSetter">
                <param name="name">month_format</param>
                <param name="value">$click.value$-01 00:00:00</param>
                <module name="ValueSetter">
                  <param name="if.$stashedEarliest1$=-12mon[priority=1]">-1mon</param>
                  <param name="if.$stashedEarliest1$=-1mon[priority=2]">-30day</param>
                  <param name="name">day_var</param>
                  <module name="Search" autoRun="True">
                    <param name="earliest">$day_var$</param>
                    <module name="TimeRangePicker" layoutPanel="panel_row2_col2" autoRun="True">
                      <param name="label">Bottom Level</param>
                      <module name="Search">
                        <param name="search">
                          <![CDATA[
index=myidx1 sourcetype=mystats | eval Day=strftime(_time,"%d") | eval Month=strftime(_time,"%Y-%m") | eval Process_Time=(time_end-time_start) | rangemap field=Process_Time >_20_seconds=20-9999999999 20_seconds=11-20 10_seconds=6-10 default=5_seconds | chart count over date_mday by range | fields _* * >_20_seconds 20_seconds 10_seconds 5_seconds | rename >_20_seconds as ">20 Seconds" 20_seconds as "<= 20 Seconds" 10_seconds as "<=10 Seconds" 5_seconds as "<=5 Seconds"
]]>
                        </param>
                        <module name="HTML">
                          <param name="html">
                            <![CDATA[
click.value:  $click.value$
<br>
$stashedEarliest1$ - $stashedLatest1$<br>
<br/>
search.timeRange.latest:  $search.timeRange.latest$
<br/>
search.timeRange.earliest:  $search.timeRange.earliest$
<br/><br>
day_var:  $day_var$
]]>
                          </param>
                          <module name="JSChart"/>
                        </module>
                      </module>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>
0 Karma

sideview
SplunkTrust
SplunkTrust

OK. Absolutely and most definitely take out these extra autoRun="True" attributes. Leave only the one at the top. Think of autoRun="True" as "when the page loads, start pushing data downstream from this particular point". If you have more than one, you're running a crazy goat rodeo of cascading pushes that will collide with eachother and cause slowness at best and craziness at worst.

So OK. Let's consider the world of inline chart/table drilldown. The modules downstream from the clickable chart/table are always hidden until the user clicks an element.

EXCEPT, that the Sideview Table module was recently (by popular request) given some new functionality around a "selectedIndex" param and also around "default.*" params, such that it can have a default selection and/or default drilldown values and thus the downstream modules can be visible on load.

But OK this doesn't matter to you because you want Charts. No problem.

There is a very advanced Sideview module called the Gate module. You almost never use it, but it's for nutty use cases like this where you need to bend time and space.

The Gate module basically allows you to crosswire one arbitrary point in the hierarchy to another arbitrary point in the hierarchy, such that pushes from point A and the $foo$ tokens thereof, will appear at point B at the correct time. It should be obvious that you can shoot yourself in the face with this (starting with, dont create loops)

but... if you bear in mind the following

1) two JSCharts will both have $click.*$ keys by default. If one is downstream from the other, some of the keys will clobber. What you do is you set the "drilldownPrefix" param on one or both. (the analog of this in the Table module is the Table's "name" param)

2) Have your JSCharts actually be more or less at the same level, ie don't have one downstream from the other.

3) Downstream from the "upper" chart, put a Gate module with a "to" param. Upstream from the "lower" chart, put a Gate moduel with an "id" param such that the two params match. (i'm being vague here - you can have those ValueSetters in between JSChart and Gate and the sum total of the $foo$ tokens will get sent through the Gate. But think about which side you want/need things to be on, that's the trick)

At this point you have a config where both charts load on page load, but nonetheless clicking chart 1 will push chart 1's drilldown tokens to the search that drives chart 2.

the specifics get pretty messy pretty fast. Also note that there is a detailed docs page with working examples about the Gate module so make sure you read through those carefully and understand them too. If you can't get it to work email me or write a comment here and I'll try to help.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...