dynamic menus not talking

[gnovak]

I created a form with 2 drop down menus. However it appears they aren't talking. The second drop down should change it's values every time I select something from the first drop down menu. However this isn't happening for some reason. I don't see any indication that it's populating again with new search results. Both the menus populate based on separate searches

How do I get these menus to talk to one another? I've looked at a lot of examples and I can't seem to find what the issue is.

Update: I have tried 3 times to paste my code in here and the formatting is horrible. Because of this, I put it on pastebin:

http://pastebin.com/SsT5HcdP

[sideview · Accepted solution]

I debug these views by converting them to Sideview Utils and picking up problems I see along the way.

1) you're not actually using the applyOuterIntentionsToInternalSearch argument on the second lister, and that'll mean that the second lister will ignore changes to the first.

2) beware of using autoRun="false". it does nothing whatsoever but you should be even more wary of having more than one autoRun="True". When you have an autoRun="True" containing another autoRun="True", bad things happen. As a result I have a zero tolerance policy on autoRun="false", cause people can get lulled into thinking that it's OK for there to be a lot of autoRun's sprinkled around.

3) You probably know this but you're not actually usign the $registry$ key from your second pulldown.

4) Never set searchWhenChanged to false. I know it feels like what you want, but it isn't. ever. set searchWhenChanged to true, and on the SubmitButton module, you can set allowSoftSubmit to true or false, as you like.

5) Iv'e posted my converted XML here. If you download Sideview Utils and start using it in your views, views like this get a bit simpler.

Your view was 111 lines of XML, and the converted view below is 66 lines (not countign whitespace lines which I add for readability). Plus as a bonus, you never have to think about intentions. 😃

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">
  <label>WAT form 2</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>

  <module name="Search" layoutPanel="viewHeader" autoRun="True">
    <param name="search">sourcetype=EPPWEB | rex field=source "^/opt/log/(?&lt;registry&gt;[^/]+)/web_server/.*$$" | fields registry | dedup registry</param>
    <param name="earliest">-60m</param>

    <module name="Pulldown">
      <param name="name">registry</param>
      <param name="label">Select Registry</param>
      <param name="valueField">$name$</param>
      <param name="staticOptions"></param>

      <module name="Search" layoutPanel="viewHeader">
        <param name="search">sourcetype="EPPWEB" daysago=1 source="/opt/log/*/web_server/info.log" WAT | rex field=_raw "downloading .*/(?&lt;filename&gt;.+?)$$" | fields filename | top filename</param>

        <module name="Pulldown">
          <param name="name">filename</param>
          <param name="label">Select Filename</param>
          <param name="valueField">$name$</param>
          <param name="staticOptions"></param>

          <module name="TimeRangePicker">
            <param name="searchWhenChanged">True</param>

            <module name="SubmitButton">
              <param name="allowSoftSubmit">True</param>
              <param name="label">Search</param>

              <module name="Search" layoutPanel="panel_row1_col1" group="WAT Test Search">
                <param name="search">sourcetype=EPPWEB source="/opt/log/$registry$/web_server/info.log" WAT | rex field=_raw "USER (?P&lt;registrar&gt;\[\d+-\w\w\]) downloading .*/(?&lt;filename&gt;.+?)$$" | chart count by registrar</param>

                <module name="EnablePreview">
                  <param name="enable">True</param>
                  <param name="display">False</param>
                </module>

                <module name="JobProgressIndicator"/>
                <module name="Paginator">
                  <param name="count">20</param>
                  <param name="entityName">results</param>

                  <module name="SimpleResultsTable">
                    <param name="count">20</param>
                    <param name="entityName">results</param>
                    <param name="drilldown">row</param>
                    <module name="ConvertToDrilldownSearch">
                      <module name="ViewRedirector">
                        <param name="viewTarget">flashtimeline</param>
                      </module>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>

EDIT : The original XML I posted failed to replace the literal "$" chars in the regexes with two dollar signs, ie $$. Because Sdieview does $foo$ replacement everywhere, including in the search param of the Search module, if you need a literal "$" character in the config you have to express it as "$$". XML has been corrected now to use $$ in regexes.

[sideview]

Yep. You can mix and match if you need to.

[gnovak]

one last question: do regular splunk modules still work in SideViews?

[sideview]

I saw your latest comment about staticOptions (strangely that one hasn't displayed for me here either so I'm only going off the email notification). setting staticOptions to blank is actually how you remove the All/* option from the menu. I had that in there because you had the equivalent in the core module. If you want all/* to be there just delete that param entirely because all/* is the default for staticOptions.

[sideview]

Strangely I'm getting notifications about new comments here from you, but those same comments aren't displaying on the site. Sorry about the trouble! unabalanced quote errors usually mean there's a literal "$" that should be replaced with a "$", but the best thing to do is to put an HTML module in and look at what the $search$ key actually is, right downstream from your Search module. That will be the exact same search that's throwing the unbalanced quotes error, so you'll be able to see where things are going wrong. And feel free to send me the entire XML - nick [at] sideviewapps.com

[sideview]

Sorry! I didn't notice the "$" that you're using in the regex itself. Because $ is a reserved character for $foo$ replacement in almost all Sideview Utils params, whenever you want an actual honest-to-god dollar character you have to use two consecutive dollar chars. So change that regex and you should be all good.

[gnovak]

Tried changing the final search to this but that didn't work either. still getting "unbalanced quotes"

[gnovak]

The XML is checking out fine. I don't know what the issue here is but the above code isn't allowing me to do anything. I just get "unbalanced quotes" as the error. SideView Utils was updated to latest version as well.

[gnovak]

ack! unbalanced quotes somewhere! looking now!

[sideview]

Yep. When an app loads new UI modules in they automatically become usable from all apps. You just need the SideviewUtils module up there, and then you can use any Sideview module int the view. Make sure to read at least the first few pages of Utils docs though.

[gnovak]

If you're just in normal Search app for splunk and not the sideviewutils app will it still work? probably stupid question, i'm going to get newer version and see

[sideview]

Sorry - you'll need the latest Sideview Utils (2.1) from the sideview site. My guess is you have the older 1.3 version from Splunkbase.

[gnovak]

Tried to paste this as a new view but it doesn't show up.

[sideview]

irony: i neglected to put an autoRun="True" in my converted view. Fixed now.

[jonuwz]

searchWhenChanged should by True

Without this, when you change your selection, the change isn't pushed downstream.

However I think there's another problem - I would have expected $registry$ to appear in the search for the 2nd dropdown somewhere if the 1st dropdown drives the options in the 2nd dropdown. Without that relationship, they are independent anyway.

What do you expect to see ?

Update :

This line in the 2nd search :

<param name="search">sourcetype="EPPWEB" daysago=1 source="/opt/log/*/web_server/info.log" WAT | rex field=_raw "downloading .*/(?<filename>.+?)$" | fields filename | top filename
</param>

Needs to refrence $registry$ in some way, otherwise the options it presents will be independent of the 1st search. Probably something like this - notice that we have to extract the registry values again, and then insert your intention '$registry' to limit the filenames returned.

<param name="search">sourcetype="EPPWEB" daysago=1 source="/opt/log/*/web_server/info.log" WAT | rex field=_raw "downloading .*/(?<filename>.+?)$" | rex field=source "^/opt/log/(?<registry>[^/]+)/web_server/.*$" | $registry$ | fields filename | top filename

Update2 : Example : ( All this is described in great detail in the UI Examples App - which is a fine place to learn this sort of stuff, plus a lot more)

The missing piece of the puzzle is this in the 2nd SearchSelectLister :

<param name="applyOuterIntentionsToInternalSearch">True</param>

Here's an example :

<?xml version="1.0"?>
<view template="dashboard.html">
  <label>Example</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SearchSelectLister" layoutPanel="mainSearchControls" group="Drilldowns">
    <param name="label">Sourcetype</param>
    <param name="settingToCreate">setting_sourcetype</param>
    <param name="search">index=_internal | stats count by sourcetype | fields - count | sort - sourcetype</param>
    <param name="searchWhenChanged">True</param>
    <param name="selected">splunkd</param>
    <param name="staticFieldsToDisplay">
      <list>
        <param name="label">All</param>
        <param name="value">*</param>
      </list>
    </param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="label">sourcetype</param>
        <param name="value">sourcetype</param>
      </list>
    </param>
    <module name="ConvertToIntention">
      <param name="settingToConvert">setting_sourcetype</param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="sourcetype">
            <param name="fillOnEmpty">True</param>
            <param name="prefix">sourcetype=</param>
            <param name="value">$target$</param>
          </param>
        </param>
      </param>
      <module name="SearchSelectLister">
        <param name="label">Component</param>
        <param name="settingToCreate">setting_component</param>
        <param name="search">index=_internal $sourcetype$ | stats count by component | fields - count | sort - component</param>
        <param name="searchWhenChanged">True</param>
        <param name="applyOuterIntentionsToInternalSearch">True</param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="label">component</param>
            <param name="value">component</param>
          </list>
        </param>
        <module name="ConvertToIntention">
          <param name="settingToConvert">setting_component</param>
          <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
              <param name="component">
                <param name="fillOnEmpty">False</param>
                <param name="prefix">component=</param>
                <param name="value">$target$</param>
              </param>
            </param>
          </param>
          <module name="HiddenSearch" autoRun="True">
            <param name="search">| gentimes start=-1 | head 1 | eval output="You chose $sourcetype$ $component$" | table output</param>
            <module name="SimpleResultsTable" layoutPanel="panel_row1_col1"/>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>

[gnovak]

I actually added that to the second search that populates the Filename drop down menu. The result is it just sits there and results display. I will take a second look. And yes, been using UI examples, trying to sort all this out.

[gnovak]

One thing I did change was the hiddensearch I took out the regex for filename since I already classified that earlier in the code. No need for the regex in the search again. I used $filename$ instead.

[gnovak]

well I tried source="/opt/log/$registry$/web_server/info.log". That didn't work, the menu showed up blank. I also tried adding | search $registry$ to the search. It also made it show up blank. If I keep it the way it was, I do get filenames show up. This is strange. I would think source="/opt/log/$registry$/web_server/info.log". would do the trick. I'm going to look again.

[gnovak]

if i change searchWhenChanged to True it will run the main search whenever i change an option. It isn't making the filename menu do a "search" in the background to populate itself when the first menu selection is changed. hmmmm

[gnovak]

I wanted what you just described where the second menu changes when you pick something from the first. I must have missed something but I wasn't sure where to add it.