All Apps and Add-ons

Pulldown module: Statically setting two values per pulldown option

Lucas_K
Motivator

What I'm trying to create is a static pulldown that is able to create, and then be referenced independently, more than a one $foo$ variable at a time.

The dynamic pull down example (app/sideview_utils/pulldown7_multivalued) is exactly what I need with the exception that I don't want to populate the combinedValue field without using a search to populate the "combinedValue" field. Is there a way I can use valueSetter to create the set of values that it would be expecting?

My usage example is a custom "time picker" which will feed both an earliest parameter to the end of a base search and a separate bucket span/timechart span option (very late in the search string) to multiple post process modules further down.

I know I can make this work with using 2 pull downs and separate values but the users of this panel won't understand what the span option is. Worse they could choose a value that removed any value from the down stream graphs and tables. ie. 1 month earliest + 1 minute time span + results table=100's of lines = Not very useful when single day span would have been prefered.

Thanks. 😉

1 Solution

sideview
SplunkTrust
SplunkTrust

Several Sideview Utils users have made custom time range pickers out of the Pulldown in exactly this manner, where the values have an earliest component and a latest component, which is very similar. You just use the same technique as that documentation page, but you use the staticOptions param to define your static options, and you don't use the valueField param at all. (See the Pulldown docs page about static Pulldowns).

So if you're making timeranges, "," is a good delimiter. here's a little example of a custom time range picker in action. I actually made each Pulldown option have 3 values - earliest, latest and span, but you get the idea and you can modify it to do only two.

<module name="Pulldown">
  <param name="name">customTime</param>
  <param name="label">Time Range</param>
  <param name="staticOptions">
    <list>
      <param name="value">-24h,+1h@h,1h</param>
      <param name="label">Last 24 hours</param>
    </list>
    <list>
      <param name="value">-60min,now,1min</param>
      <param name="label">Last 60 minutes</param>
    </list>
  </param>
  <module name="ValueSetter">
    <param name="name">customTimeSplit</param>
    <param name="delim">,</param>
    <param name="value">$customTime$</param>
    <module name="Search">
      <param name="search">index=* | timechart count span="$customTimeSplit[2]$"</param>
      <param name="earliest">$customTimeSplit[0]$</param>
      <param name="latest">$customTimeSplit[1]$</param>
      <module name="Pager">
        <module name="Table"/>
      </module>
    </module>
  </module>
</module>

View solution in original post

Lucas_K
Motivator

That's correct.

The situation is that we only have 3-4 options and want to lock down what is available into the least number of dropdowns possible.

0 Karma

sideview
SplunkTrust
SplunkTrust

Several Sideview Utils users have made custom time range pickers out of the Pulldown in exactly this manner, where the values have an earliest component and a latest component, which is very similar. You just use the same technique as that documentation page, but you use the staticOptions param to define your static options, and you don't use the valueField param at all. (See the Pulldown docs page about static Pulldowns).

So if you're making timeranges, "," is a good delimiter. here's a little example of a custom time range picker in action. I actually made each Pulldown option have 3 values - earliest, latest and span, but you get the idea and you can modify it to do only two.

<module name="Pulldown">
  <param name="name">customTime</param>
  <param name="label">Time Range</param>
  <param name="staticOptions">
    <list>
      <param name="value">-24h,+1h@h,1h</param>
      <param name="label">Last 24 hours</param>
    </list>
    <list>
      <param name="value">-60min,now,1min</param>
      <param name="label">Last 60 minutes</param>
    </list>
  </param>
  <module name="ValueSetter">
    <param name="name">customTimeSplit</param>
    <param name="delim">,</param>
    <param name="value">$customTime$</param>
    <module name="Search">
      <param name="search">index=* | timechart count span="$customTimeSplit[2]$"</param>
      <param name="earliest">$customTimeSplit[0]$</param>
      <param name="latest">$customTimeSplit[1]$</param>
      <module name="Pager">
        <module name="Table"/>
      </module>
    </module>
  </module>
</module>

Lucas_K
Motivator

ahhh it was the "-24h,+1h@h,1h" was what I was looking for followed by the valuesetter module.

I didn't know how to "set" and then retrieve the values. I'd tried doing it several ways but it just wouldn't take.

Will have to try it tomorrow.

Thanks for that!

0 Karma

sideview
SplunkTrust
SplunkTrust

When you say that example "is exactly what I need with the exception that I don't want to populate the combinedValue field without using a search to populate the "combinedValue" field.", do you mean that you want to do the same thing, but with "static" options and not using a search to render dynamic options?

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...