All Apps and Add-ons

SearchBar + EventsViewer + FlashTimeline + drilldown on HiddenPostProcess tables

MikhailArefiev
Explorer

We are looking to create an application view which will allow our operator to search logs using an eventtype-limited SearchBar, select time ranges with FlashTimeline, browse raw events with an EventsViewer, and see some aggregate information (e. g. top-10 user names in the selected time range) in tables computed by the means of HiddenPostProcess. Here is a desired panel structure of the view:

view structure

We can achieve this much with raw Advanced XML, but we also want to make rows of tables with aggregate info clickable, so that it would be possible to drill down on values from these tables without having to add them to the search bar manually. E. g. if a table shows top usernames, a drilldown click on it would add «username=FOO» to the search bar.

It is possible to do this kind of drilldown with Advanced XML? It is possible to do it with the SideView Utils toolset?

sideview
SplunkTrust
SplunkTrust

Sure. It's possible with Sideview Utils, and not really with just the core Advanced XML, but it might still be a lot of fiddly work to get it to be exactly what you want.

Here's a quick and dirty starting point for you.

<view onunloadCancelJobs="False" autoCancelInterval="100" isVisible="True" isSticky="True">
  <!--  autoCancelInterval is set here to 100  -->
  <label>Sideview Search</label>
  <module name="SideviewUtils" layoutPanel="appHeader">
    <param name="customJavascript">sideview_utils/report.js sideview_utils/save_create_patches.js</param>
    <param name="customStylesheet">sideview_utils/report.css</param>
  </module>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.*</param>
    <param name="maxSize">1</param>
    <param name="clearOnJobDispatch">True</param>
  </module>
  <module name="Message" layoutPanel="graphArea">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">2</param>
  </module>
  <module name="Message" layoutPanel="resultsAreaLeft">
    <param name="filter">pageControls</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>

  <module name="URLLoader" layoutPanel="navigationHeader" autoRun="True">
    <param name="keepURLUpdated">True</param>


    <module name="TimeRangePicker" layoutPanel="mainSearchControls">
      <param name="selected">Last 4 hours</param>
      <param name="searchWhenChanged">True</param>

      <module name="Button">
        <param name="allowSoftSubmit">True</param>

        <module name="CustomBehavior">
          <param name="customBehavior">hideDownstreamUntilSearchSubmitted</param>
        </module>

        <module name="FlashTimeline" layoutPanel="graphArea">
          <param name="height">75px</param>
          <param name="width">100%</param>

          <module name="SearchBar">

            <module name="Search">
              <param name="search">$searchBar$ | table *</param>

              <!-- sidebar -->

              <module name="PostProcess" layoutPanel="sidebar">
                <param name="search">stats count by sourcetype</param>
                <module name="ValueSetter">
                  <param name="name">sideview.xField</param>
                  <param name="value">sourcetype</param>

                  <module name="Table">
                    <module name="Redirector">
                      <param name="generalSearchTermField">searchBar</param>
                      <param name="url">search_prototype</param>
                      <param name="arg.searchBar">$searchBar.rawValue$</param>
                      <param name="arg.earliest">$search.timeRange.earliest$</param>
                      <param name="arg.latest">$search.timeRange.latest$</param>
                    </module>
                  </module>
                </module>
              </module>


              <module name="PostProcess" layoutPanel="sidebar">
                <param name="search">stats count by source</param>

                <module name="ValueSetter">
                  <param name="name">sideview.xField</param>
                  <param name="value">source</param>

                  <module name="Table">
                    <module name="Redirector">
                      <param name="generalSearchTermField">searchBar</param>
                      <param name="url">search_prototype</param>
                      <param name="arg.searchBar">$searchBar.rawValue$</param>
                      <param name="arg.earliest">$search.timeRange.earliest$</param>
                      <param name="arg.latest">$search.timeRange.latest$</param>
                    </module>
                  </module>
                </module>
              </module>

              <!-- end sidebar -->

              <!-- begin events panel -->

              <module name="Count" layoutPanel="pageControls">
                <param name="options">
                  <list>
                    <param name="text">10</param>
                    <param name="value">10</param>
                  </list>
                  <list>
                    <param name="text">20</param>
                    <param name="value">20</param>
                  </list>
                  <list>
                    <param name="text">50</param>
                    <param name="selected">True</param>
                    <param name="value">50</param>
                  </list>
                </param>

                <module name="SoftWrap" layoutPanel="resultsOptions">
                  <param name="enable">True</param>

                  <module name="RowNumbers">
                    <param name="default">false</param>

                    <module name="MaxLines">
                      <param name="options">
                        <list>
                          <param name="text">5</param>
                          <param name="selected">True</param>
                          <param name="value">5</param>
                        </list>
                        <list>
                          <param name="text">10</param>
                          <param name="value">10</param>
                        </list>
                        <list>
                          <param name="text">20</param>
                          <param name="value">20</param>
                        </list>
                        <list>
                          <param name="text">50</param>
                          <param name="value">50</param>
                        </list>
                        <list>
                          <param name="text">100</param>
                          <param name="value">100</param>
                        </list>
                        <list>
                          <param name="text">200</param>
                          <param name="value">200</param>
                        </list>
                        <list>
                          <param name="text">All</param>
                          <param name="value">0</param>
                        </list>
                      </param>
                      <module name="Segmentation" >
                        <param name="options">
                          <list>
                            <param name="text">inner</param>
                            <param name="selected">True</param>
                            <param name="value">inner</param>
                          </list>
                          <list>
                            <param name="text">outer</param>
                            <param name="value">outer</param>
                          </list>
                          <list>
                            <param name="text">full</param>
                            <param name="value">full</param>
                          </list>
                          <list>
                            <param name="text">raw</param>
                            <param name="value">raw</param>
                          </list>
                        </param>
                        <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" >
                          <param name="entityLabel">events</param>
                          <param name="entityName">events</param>
                        </module>

                        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
                        </module>

                      </module>

                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>

The only tricky part is the sidebars where the custom Table's are shown, with custom drilldowns that feed back into the SearchBar. The drilldowns there are not by default going to have all the subtleties that you might be used to. For instance if you click them a second time they'll add the same searchterm twice. And if you try and hold down ALT to do a NOT click, it wont work.
Also lots of CSS tweaking will need to be done - this quick and dirty version has a lot of little simple CSS flaws that I don't have time to hunt down for you. 😃

Also, the way the sidebar drilldowns are set up basically borrows something from the Report module to make it work - it sets a key called "sideview.xField", and this key helps the Redirectors know what the relevant field names are to implement the drilldown. By setting this and setting sideview.splitByField, you could actually have quite complex charts in the sidebar, with split-by fields even. And even the "NULL" and "OTHER" clicks would work correctly, expanding out to the correct searchterms. What I've shown here however just uses vey simple postprocess searches and very simple rendering into 2-column tables...

One more important note -- you will want to read the postProcess intro page in the latest Sideview Utils app. This view is committing a sin of using postprocess in a situation where the base search is basically just raw events. This leads to a lot of nasty problems as the postprocess intro page can explain for you. there isn't really a way to use postprocess int he sidebar here, as you have specified, without just risking those pitfalls, but you should make sure to be aware of them.

And again, make sure you're on the latest Sideview Utils. It gets updated about once every week or two so if your last update was more than a week ago, you're out of date. 😃

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...