Splunk Search

Modify token based on user moving forward and back on a panel's search results.

BearMormont
Path Finder

On my dashboard I have a panel that displays a table. When the user clicks on the table, the drilldown sets a token based on the $click.value$ of the drilldown, which in turn filters another panel below it. My challenge is when the user pages through the search results of the top panel, the output in the bottom panel remains the same until they click on something new (which is expected) but some of the users are confused as to why the bottom panel is still displaying information from a previous page of search results.

Is there an event where I can modify a token based on the user paging forward or backward in a panel's search results?

0 Karma

niketn
Legend

@BearMormont, Although Splunk provides Paginator with tableView, it does not give SplunkJS event handler for configuring click on Paginator: http://docs.splunk.com/DocumentationStatic/WebFramework/1.0/compref_table.html. However, in your case you want to unset the drilldown token whenever someone moves out of a particular page with drilldown. Which in turn implies the token can be unset whenever the table is rendered again after setting the token.

SplunkJS provides tableView.on("rendered",function(){} to capture event when the table is rendered. You can use SplunkJS stack to unset the token for submitted and default token models using the same. PS: This also means that when you change any other input/token including dashboard refresh then the drilldown token will be unset. However, that would be an expected behavior as per your use case:

alt text

Following is the run anywhere Simple XML Dashboard Code:

<form script="table_render_token_reset.js">
  <label>Token Reset on Table Navigation</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <title>Splunkd Top Components with Errors</title>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label>Select Time</label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <table id="table1">
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| top 20 component showperc=f countfield="Errors"</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">5</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="tokComponent">$click.value$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row depends="$tokComponent$">
    <panel>
      <title>Error for Splunk component $tokComponent$ over selected time</title>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO component="$tokComponent$"
          | timechart count as "Errors"</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.axisTitleX.text">Time</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

Following is the code for table_render_token_reset.js JavaScript file to be included in the Simple XML Dashboard. This should ideally be placed under $SPLUNK_HOME/etc/apps/<YourAppName>/appserver/static. You might have to created appserver/static folder if the same does not exist already.

PS: Since this change requires Static file change you might have to refresh/restart/bump your Splunk instance and may also require to clear your internet browser history for the changes to take effect.

 require([
 "jquery",
 "splunkjs/mvc",
 "splunkjs/mvc/simplexml/ready!"
          ], function($,mvc) {
    mvc.Components.get('table1').getVisualization(function(tableView) {
        tableView.on('rendered', function() {
                var defaultTokenModel=mvc.Components.get("default");
                var submittedTokenModel=mvc.Components.get("submitted");
                defaultTokenModel.unset("tokComponent");
                submittedTokenModel.unset("tokComponent");
        });
    });     
});

Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...