All Apps and Add-ons

Tab module not resolving the value set in the valuesetter module

RickGenesis
Explorer

I have a valuesetter that I use to set a variable at the top of my dashboard as per this answer
[global variable][1]

  <module name="ValueSetter" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="name">AppName</param>
    <param name="value">fred</param>

I then use this variable through out my dashboard, for some reason the tabs module doesn't resolve the value, the changes tab that has a hard coded value(fred) works, and the HTLM module directly above the tab module also does so I assume I am getting the value passed downstream but the incidents tab where I pass in the value to a macro doesnt work.

<module name="HTML" layoutPanel="panel_row2_col1">
  <param name="html"><![CDATA[
    <p>$AppName$ filtered list of Changes, incidents and Alarms</p>
    ]]> 
  </param>
</module> <!-- the value isnt resolved below this -->
<module name="Tabs" autoRun="True" layoutPanel="panel_row2_col1" group="ITSM">
  <param name="name">ITSM_Tab</param>
  <param name="staticTabs">
    <list>
      <param name="label">Changes</param>
      <param name="value">`ITS_Mcr_AppITSMChanges(fred)`</param>
    </list>
    <list>
      <param name="label">Incidents</param>
      <param name="value">`ITS_Mcr_AppITSMChanges($AppName$)`</param>
    </list>
    <list>
      <param name="label">Alerts</param>
      <param name="value"></param>
    </list>
  </param>
  <module name="Search">
    <param name="search">
      $ITSM_Tab$
    </param>

any help much appreciated.

1 Solution

sideview
SplunkTrust
SplunkTrust

My previous answer was wrong, so I deleted it. Sorry about that - autoRun="True" can indeed cause this kind of bug and I leapt to a conclusion here before looking more deeply.

The problem is that the Tabs module does not allow $foo$ replacement into its values. Neither the static tab values nor the dynamic tab values allow $foo$ replacement so any $foo$ tokens in there will just be passed downstream verbatim.

However you're not the first person to ask for this, nor the second. So I'll put it in the queue and it'll be in some version of Utils going forward. I always think I've done a good job making everything in Sideview Utils support $foo$ substitution, but customers are always even better at finding the spots I missed. 😃 And as you can see from the release notes there have been quite a few items of "such and such param now supports $foo$-substitution".

Anyway, sorry for the inconvenience and thanks for the report.

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

My previous answer was wrong, so I deleted it. Sorry about that - autoRun="True" can indeed cause this kind of bug and I leapt to a conclusion here before looking more deeply.

The problem is that the Tabs module does not allow $foo$ replacement into its values. Neither the static tab values nor the dynamic tab values allow $foo$ replacement so any $foo$ tokens in there will just be passed downstream verbatim.

However you're not the first person to ask for this, nor the second. So I'll put it in the queue and it'll be in some version of Utils going forward. I always think I've done a good job making everything in Sideview Utils support $foo$ substitution, but customers are always even better at finding the spots I missed. 😃 And as you can see from the release notes there have been quite a few items of "such and such param now supports $foo$-substitution".

Anyway, sorry for the inconvenience and thanks for the report.

0 Karma

RickGenesis
Explorer

No problem, thanks for the update, I have edited my Tab values so they just have the name of the macro and then I build the macro string up in the search module using the foo value, $ITSM_Tab$($AppName$) works like a charm.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...