All Apps and Add-ons

Sideview Search Module Does Not Execute Search

mconte01
Explorer

I'm trying to use the dynamic HTML feature of Sideview to inject search results into my custom HTML. The problem is, any time I put a "Search" module into a dashboard the page hangs, and displays "Loading..." in the upper-right corner of the page. This happens even with an empty Search module. For instance, here is the page I'm trying to create. (Sorry for the formatting but the editor wouldn't let me insert an XML snippet)

XML:

 module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
    param name="search"> | savedsearch last_command_by_engine</param>
    module name="HTML">
      param name="loadingText">Searching...</param>
      param name="src">last_commands_table.html</param>
    /module>   
/module>

last_commands _table.html:

 <h1>Results: $results[0]$</h1>
    <h1>Search: $search$</h1>
    <table> 
            <thead>
                    <th>0</th>
                    <th>1</th>
                    <th>2</th>
                    <th>3</th>
                    <th>4</th>
                    <th>5</th>
                    <th>6</th>
            </thead>
            <tbody>
                    <td></td>
                    <td></td>
                    <td></td>
                    <td></td>
                    <td></td>
                    <td></td>
            </tbody>
    </table>

The HTML template is rendered but the search is not carried out. There's just the "Loading..." message at the top and nothing else happens.

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

Note back on the Sideview Utils documentation, on the homepage, in the section "How do I start using all this?", there it says that in any view where you want to use a Sideview UI module, you MUST include the "SideviewUtils" module. The SideviewUtils module is necessary because it brings in common code and functionality that all other Sideview modules need. It's invisible and takes up no space so you can put it anywhere you like. I recommend hiding it at the top of the view next to the AccountBar so it's out of the way.

While I could in theory make every Sideview module check for the presence of the SideviewUtils module and give an informative alert if it's absent, since I have no other way to put globally available code into the system, I'd have to duplicate that error-checking code in every single Sideview Utils module and thus far I've been unwilling to do that.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Note back on the Sideview Utils documentation, on the homepage, in the section "How do I start using all this?", there it says that in any view where you want to use a Sideview UI module, you MUST include the "SideviewUtils" module. The SideviewUtils module is necessary because it brings in common code and functionality that all other Sideview modules need. It's invisible and takes up no space so you can put it anywhere you like. I recommend hiding it at the top of the view next to the AccountBar so it's out of the way.

While I could in theory make every Sideview module check for the presence of the SideviewUtils module and give an informative alert if it's absent, since I have no other way to put globally available code into the system, I'd have to duplicate that error-checking code in every single Sideview Utils module and thus far I've been unwilling to do that.

mconte01
Explorer

Nevermind, there was a typo in the search itself. Thank you for the help.

0 Karma

mconte01
Explorer

Thanks. The "Loading..." message is now gone and the $search$ token is being properly replaced. But I'm not seeing and search results. I believe the search is being run because when I tried to run a saved search that didn't exist, I got an error. I can't figure out why I'm not seeing the results.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...