All Apps and Add-ons

Sideview utils pulldown stopped working after upgrading to Splunk 5

tsmithsplunk
Path Finder

After the Splunk 5 upgrade, a dashboard using a Pulldown module malfunctioned. I'm using Sideview Utils 1.3.5. The specific error msg is "ERROR - Pulldown is configured statically but with only a single static option."

I also get various errors when saving the view:
"Misconfigured view 'uit_usage' - Unknown parameter 'valueField' is defined for module Pulldown. Make sure the parameter is specified in Pulldown.conf."

"Misconfigured view 'uit_usage' - Unknown parameter 'staticOptions' is defined for module Pulldown. Make sure the parameter is specified in Pulldown.conf"

Perhaps Sideview utils needs to be reinstalled?

here's the view xml:

<?xml version='1.0' encoding='utf-8'?>





<module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
</module>

<module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
</module>

<module name="SavedSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="name">UIT Usage</param>

    <module name="HTML">

        <param name="html"><![CDATA[
                      <div style="font-weight:bold; font-size:1.2em">Top 30 Orgs by usage over the last 7 days</div>
        ]]></param>
                <!--
                <param name="html"><![CDATA[
                      <div style="font-weight:bold; font-size:1.2em">Top 30 Orgs by usage during the 13.2 UIT period</div>
        ]]></param>
                -->
    </module>

    <module name="Pulldown">
        <param name="name">orgList</param>
        <param name="label">See daily counts by choosing an Org below or from this option list</param>
        <param name="postProcess">dedup applog_orgName | sort applog_orgName</param>
        <param name="valueField">applog_orgName</param>
        <param name="staticOptions"></param>

        <module name="PostProcess" layoutPanel="panel_row1_col1_grp1">
            <param name="search">chart count over applog_orgName | sort 30 count desc</param>

            <module name="HiddenChartFormatter">
                <param name="charting.axisTitleY.text">Organization</param>
                <param name="charting.legend.placement">none</param>
                <param name="charting.chart">bar</param>
                <param name="charting.axisTitleX.text">Number of Commands</param>

                <module name="FlashChart">
                    <param name="width">100%</param>
                    <param name="height">500px</param>

                    <!-- changing the drill down to show daily counts for the selected org -->
                    <module name="PostProcess" layoutPanel="panel_row2_col1">
                        <param name="search">where applog_orgName="$click.value$" | timechart count by applog_orgName span=1h</param>

                        <module name="SimpleResultsHeader">
                            <param name="entityName">results</param>
                            <param name="headerFormat">Daily usage for $click.value$</param>
                        </module>

                        <module name="HiddenChartFormatter">
                            <param name="charting.axisTitleY.text">Commands</param>
                            <param name="charting.legend.placement">none</param>
                            <param name="charting.chart">column</param>
                            <param name="charting.axisTitleX.text">Day</param>

                            <module name="FlashChart">
                                <param name="width">100%</param>
                                <param name="height">200px</param>
                            </module>
                        </module>
                    </module>

                </module>
            </module>
        </module>

        <module name="PostProcess" layoutPanel="panel_row2_col2">
            <param name="search">where applog_orgName="$orgList$" | timechart count by applog_orgName span=1h</param>

            <module name="SimpleResultsHeader">
                <param name="entityName">results</param>
                <param name="headerFormat">Daily usage for $orgList$</param>
            </module>

            <module name="HiddenChartFormatter">
                <param name="charting.axisTitleY.text">Commands</param>
                <param name="charting.legend.placement">none</param>
                <param name="charting.chart">column</param>
                <param name="charting.axisTitleX.text">Day</param>

                <module name="FlashChart">
                    <param name="width">100%</param>
                    <param name="height">200px</param>
                </module>
            </module>
        </module>

    </module>   
</module>

1 Solution

sideview
SplunkTrust
SplunkTrust

Well your view is using params that only exist in Sideview Utils 2.X, so clearly that app has a dependency on Sideview Utils 2.X, and not 1.3.5.

I'm thinking that in your upgrade to Splunk 5, you inadvertently reverted from a recent Sideview Utils to the very old 1.3.5 version?

http://sideviewapps.com/apps/sideview-utils

and if you want to read the release notes you can see valueField and staticOptions in there:
http://sideviewapps.com/apps/sideview-utils/release-notes/

and remember to get on the mailing list so you can get a litlte email when there are new releases.
http://sideviewapps.com/apps/sideview-utils/mailing-list/

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

Well your view is using params that only exist in Sideview Utils 2.X, so clearly that app has a dependency on Sideview Utils 2.X, and not 1.3.5.

I'm thinking that in your upgrade to Splunk 5, you inadvertently reverted from a recent Sideview Utils to the very old 1.3.5 version?

http://sideviewapps.com/apps/sideview-utils

and if you want to read the release notes you can see valueField and staticOptions in there:
http://sideviewapps.com/apps/sideview-utils/release-notes/

and remember to get on the mailing list so you can get a litlte email when there are new releases.
http://sideviewapps.com/apps/sideview-utils/mailing-list/

0 Karma

tsmithsplunk
Path Finder

That must be it. I looked back in my notes from a year ago when sideview utils was first installed and I had v2.2.2. I have no idea how 1.3.5 got installed. I have informed IT and I'm sure once the new version gets installed things will start working. Many thanks!

0 Karma

tsmithsplunk
Path Finder

Does anyone know if the sideview utils Pulldown module can use a saved search? I've been tinkering with this and it appears like the Pulldown is not recognizing the upstream SavedSearch.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...