All Apps and Add-ons

Custom FlashTimeLine using Sideview Utils

KarunK
Contributor

Hi All,

I am making a custom flashtimeline dashboard with side-view util. The page loads perfectly, But i cannot search on it. Its dont do anything.

It will work once I remove
module="SuggestedFieldViewer"

Can't figure out the reason or any solution.

Can anyone please help ?

Thanks in Advance

<view autoCancelInterval="90" isPersistable="true" isSticky="false" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" stylesheet="custom.css" template="search.html">






False
2


splunk.search.
True
1



False
true
True
true

True
All time

True

splunk.search.job
True
2


True
report_builder_define_data
report_builder_format_report


100%
95px


host sourcetype source

report_builder_format_report



pageControls
True
1




10
10


20
20


50
True
50



True
splIcon-events-list
True
independent

event
splIcon-events-list
events
Events List
events

event


events
10

True




5
True
5


10
10


20
20


50
50


100
100


200
200


All
0





inner
True
inner


outer
outer


full
full


raw
raw



full
report_builder_format_report


events
10








event
splIcon-events-table
events
Events Table
events

events


events
10



events


events
10






result
splIcon-results-table
results
Results Table
results

result


True
show

results
10



results
all


True
flashtimeline




results
10







Results Chart
splIcon-results-chart
independent
job && !job.isCanceled() && job.hasOwnProperty("_reportSearch") && !job.areResultsTransformed()

event
events
events



result
results
results

True
show

Formatting options
True
secondary
serializeAll

show
true

True
serializeAll
Format

General
Chart title









X-axis


Y-axis










100%
20
300px


flashtimeline











report_builder_format_report











`

1 Solution

sideview
SplunkTrust
SplunkTrust

It's because of a bug in SuggestedFieldViewer. If you don't define the 'exclude' param, then it throws an exception. (It would be very easy to fix the bug so hopefully someone will notice this answer and file something to fix it).

In the meantime you can just be careful with the SuggestedFieldViewer params.
For instance here's the config that flashtimeline itself uses and if you replace your <module name="SuggestedFieldViewer" /> with this, it'll work.

<module name="SuggestedFieldViewer">
  <param name="minDistinctCount">1</param>
  <param name="minFrequency">0.5</param>
  <param name="maxFields">50</param>
  <param name="exclude">
  <list>^date_.*</list>
  </param>
  <param name="link">
  <param name="view">report_builder_format_report</param>
  </param>
</module>

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

It's because of a bug in SuggestedFieldViewer. If you don't define the 'exclude' param, then it throws an exception. (It would be very easy to fix the bug so hopefully someone will notice this answer and file something to fix it).

In the meantime you can just be careful with the SuggestedFieldViewer params.
For instance here's the config that flashtimeline itself uses and if you replace your <module name="SuggestedFieldViewer" /> with this, it'll work.

<module name="SuggestedFieldViewer">
  <param name="minDistinctCount">1</param>
  <param name="minFrequency">0.5</param>
  <param name="maxFields">50</param>
  <param name="exclude">
  <list>^date_.*</list>
  </param>
  <param name="link">
  <param name="view">report_builder_format_report</param>
  </param>
</module>
0 Karma

sideview
SplunkTrust
SplunkTrust

The problem is that you guys are using <item>. Note that <item> is not what I said in my answer and indeed <item> is not supported by the advanced XML. Replace it with <list> and you'll be fine.

0 Karma

therealdpk
Path Finder

I found a really lame work-around. Replace the ... xml with just:

<param name="exclude">€</param>

The buggy javascript will try to use whatever you have between as an array, and JS will treat a string as an array so this basically gives it what it wants. I chose the euro symbol because it will never appear as one of my keys.

This solution means that you'll see date_ in the suggested field viewer. But eh.

0 Karma

therealdpk
Path Finder

Can you unmark this answer as accepted @KarunK?

I can confirm that this does not fix the problem. There does indeed seem to be a bug in SuggestedFieldViewer, but adding the exclude does not seem to make a difference.

Worth pointing out: the block that is not working is copied from flashtimeline's source. If you use simply:

^date_.*

you get a different error but params["exclude"] is indeed set. I have a feeling that is not fully supported by Splunk, but who knows.

0 Karma

KarunK
Contributor

Thanks for that. Really Appreciate that. It worked. But strangely I have tried the same params in different order. But didn't work. So the params has to be listed in the same order shown above.

Param listing order which DIDN'T WORKED is as below.

.......NOT WORKING......


50
1
0.5

report_builder_format_report


^date_.*

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...