Dashboards & Visualizations

AutoRun form from populated dropdown when only one item in field

alacercogitatus
SplunkTrust
SplunkTrust

So let's say I'm working on a modular input for GoogleApps. It's being designed to support multiple domains within the same MI. So I have a form dashboard with a dropdown that is populated with the different domains contained within the data. (example.com and example.org for ... example). So if you are a particular person running a single domain (example.com) I want the form to auto execute IF DROPDOWN_DOMAIN_COUNT == 1. Thoughts?

1 Solution

sideview
SplunkTrust
SplunkTrust

Well, I don't think there's any way to do it without writing some custom Javascript.

If you're using Sideview Utils there are a couple things that make this particular solution a lot easier to put together, although you still need some custom JS.

To back up a second, Sideview Utils is an app, available as a free download if you accept the license, from the Sideview site -- ( http://sideviewapps.com/apps/sideview-utils ). The app packages a number of custom modules as well as several other useful tools. Those custom modules can be used in place of certain other core Splunk modules, and they offer simpler but at the same time more powerful ways to build your Splunk views and dashboards.

Then, even considering the greatly expanded possibilities of what you can do with no custom code at all, past that there is always a blue-sky envelope past which you need custom code.

This requirement of yours is actually one of that latter kind. Customizing this involves monkeying with when the module framework allows a "push" to proceed and as it happens this is a card that the Splunk module framework plays pretty close to the vest.

Anyway, I put together a quick packaged example showing exactly this, including the custom JS to run it. It uses just the index=_internal data so it should run fine on your instance.

1) Here is the XML.

<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <label>Button Example</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="HTML" layoutPanel="viewHeader">
    <param name="html"><![CDATA[
    <h1>Button - An example allowing automatic submission conditionally</h1>
    ]]></param>
  </module>

  <!-- EXAMPLE BEGIN -->
  <module name="Search" layoutPanel="panel_row2_col1" autoRun="True">
    <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="splunkd" | dedup series | sort series | fields series</param>
    <param name="earliest">-1h</param>
    <param name="latest">now</param>

    <module name="Pulldown">
      <param name="name">series</param>
      <param name="label">Sourcetype:</param>
      <param name="template">series="$value$"</param>
      <param name="valueField">series</param>
      <param name="staticOptions"></param>

      <module name="Button">
        <param name="allowAutoSubmit">False</param>
        <param name="allowSoftSubmit">True</param>
        <param name="customBehavior">autoSubmitWhenOnlyOneValue</param>

        <module name="Search">
          <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" $series$ | stats min(eps) avg(eps) max(eps) </param>
          <param name="earliest">-1h</param>
          <param name="latest">now</param>

          <module name="Pager">

            <module name="Table"></module>

          </module>
        </module>
      </module>
    </module>
  </module>
  <!-- EXAMPLE END -->

</view>

2) Here is the Javascript which you should put in your app's appserver/static/application.js file

NOTE: that the value of the Pulldown's "name" param is embedded in this JS so you'll have to change that if/when you adapt this example for your own use.

if (typeof(Sideview)!="undefined") {

    Sideview.utils.declareCustomBehavior("autoSubmitWhenOnlyOneValue", function(buttonModule) {
        var methodReference = buttonModule.isReadyForContextPush.bind(buttonModule);

        buttonModule.isReadyForContextPush = function() {
            if (!this.allowAutoSubmit && !this.isPageLoadComplete()) {
                var context = this.getContext();
                // "series" is the value of the Pulldown's "name" param 
                var selectElement = context.get("series.element");
                if (selectElement.length>0);{
                    var numberOfOptions = selectElement[0].options.length;
                    return (numberOfOptions == 1);
                }
            }
            return methodReference();
        }
    });
}

3) And to artificially trigger the case when there's only one value in the Pulldown, change the Search upstream from the Pulldown so that it only ever matches one sourcetype, like so:

index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="splunkd" | dedup series | sort series | fields series

View solution in original post

sideview
SplunkTrust
SplunkTrust

Well, I don't think there's any way to do it without writing some custom Javascript.

If you're using Sideview Utils there are a couple things that make this particular solution a lot easier to put together, although you still need some custom JS.

To back up a second, Sideview Utils is an app, available as a free download if you accept the license, from the Sideview site -- ( http://sideviewapps.com/apps/sideview-utils ). The app packages a number of custom modules as well as several other useful tools. Those custom modules can be used in place of certain other core Splunk modules, and they offer simpler but at the same time more powerful ways to build your Splunk views and dashboards.

Then, even considering the greatly expanded possibilities of what you can do with no custom code at all, past that there is always a blue-sky envelope past which you need custom code.

This requirement of yours is actually one of that latter kind. Customizing this involves monkeying with when the module framework allows a "push" to proceed and as it happens this is a card that the Splunk module framework plays pretty close to the vest.

Anyway, I put together a quick packaged example showing exactly this, including the custom JS to run it. It uses just the index=_internal data so it should run fine on your instance.

1) Here is the XML.

<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
  <label>Button Example</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="HTML" layoutPanel="viewHeader">
    <param name="html"><![CDATA[
    <h1>Button - An example allowing automatic submission conditionally</h1>
    ]]></param>
  </module>

  <!-- EXAMPLE BEGIN -->
  <module name="Search" layoutPanel="panel_row2_col1" autoRun="True">
    <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="splunkd" | dedup series | sort series | fields series</param>
    <param name="earliest">-1h</param>
    <param name="latest">now</param>

    <module name="Pulldown">
      <param name="name">series</param>
      <param name="label">Sourcetype:</param>
      <param name="template">series="$value$"</param>
      <param name="valueField">series</param>
      <param name="staticOptions"></param>

      <module name="Button">
        <param name="allowAutoSubmit">False</param>
        <param name="allowSoftSubmit">True</param>
        <param name="customBehavior">autoSubmitWhenOnlyOneValue</param>

        <module name="Search">
          <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" $series$ | stats min(eps) avg(eps) max(eps) </param>
          <param name="earliest">-1h</param>
          <param name="latest">now</param>

          <module name="Pager">

            <module name="Table"></module>

          </module>
        </module>
      </module>
    </module>
  </module>
  <!-- EXAMPLE END -->

</view>

2) Here is the Javascript which you should put in your app's appserver/static/application.js file

NOTE: that the value of the Pulldown's "name" param is embedded in this JS so you'll have to change that if/when you adapt this example for your own use.

if (typeof(Sideview)!="undefined") {

    Sideview.utils.declareCustomBehavior("autoSubmitWhenOnlyOneValue", function(buttonModule) {
        var methodReference = buttonModule.isReadyForContextPush.bind(buttonModule);

        buttonModule.isReadyForContextPush = function() {
            if (!this.allowAutoSubmit && !this.isPageLoadComplete()) {
                var context = this.getContext();
                // "series" is the value of the Pulldown's "name" param 
                var selectElement = context.get("series.element");
                if (selectElement.length>0);{
                    var numberOfOptions = selectElement[0].options.length;
                    return (numberOfOptions == 1);
                }
            }
            return methodReference();
        }
    });
}

3) And to artificially trigger the case when there's only one value in the Pulldown, change the Search upstream from the Pulldown so that it only ever matches one sourcetype, like so:

index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="splunkd" | dedup series | sort series | fields series

sideview
SplunkTrust
SplunkTrust

Cool. Well to do it without Utils would be trickier. For one thing you don't have the allowAutoSubmit behavior that the Button has, and for another thing you don't have the "foo.element" key that the Pulldown drops into the context. Both of these Sideview-isms are saving us some significant custom code here and giving us a headstart.

Thinking about it, the "easiest" way is probably to BOTH patch a NullModule, implementing isReadyForContextPush on it, AND patch SearchSelectLister. Both are advanced areas and tricky to patch, so you'll want to have a pretty deep understanding of both.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Marked As Accepted. I'll play with this when I have a little bit more time, but I was also trying to avoid having 3rd party dependencies for this particular app. But I love sideviews anyway 😄

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...