![]() With the autoRun="true" on the Search module, the very first push on page load doesn't hide the checkbox because nobody has pushed the TimeRangePicker's data downstream yet. IN this case you should move it up to the TimeRangePicker and not have any autoRun on the Search module. It actually tells any module "when the page loads, start pushing data to all downstream from this point", and as such it should always be up at the top of the hierarchy. You have an autoRun="True" but you've made a common mistake which is to put it on the Search module thinking it tells the Search module to run it's search. For the second you meant to check the getLatestTimeTerms not getEarliestTimeTerms.Ĭhanging that alone gets it to mostly work.Ä¢) There is also a second lesser problem though. Now the checkbox goes away as soon as I change the time range and never comes back regardless of the setting.Ä¡) The main problem is that your if statement is only firing if the earliest time term is and also the earliest time term is "now". If & this.getContext().get("search").getTimeRange().getEarliestTimeTerms()="now")Īnd yes, I rebooted splunkweb to make sure application.js has been read by splunk after my change.Ä®DIT: I just found 2 errors, thanks to google developper tools.Ä¡- there was a brace missing in my javascript.Ä¢- I needed to get the context from "this". Var methodReference = (checkBoxModule) ĬheckBoxModule.onContextChange = function() ![]() ("LRO_ShowAutoRefreshCheckBox", function(checkBoxModule) But it's all there.Īnd here is the code I added in application.js: OK the code looks partly marked as code partly as regular comments. Index=os * | rex 'lvn-(?)-' | dedup Line | table Line | sort Lineįor 5 mins auto-refresh select the "Last 60 minutes" time range. It should only be visible when the user selects "Last 60 minutes" in the TimeRangePicker. The checkbox remains visible regardless of the time range I select. A good one if possible: A search that we know was run by an actual user.Īs discussed earlier, stats first(user) by search_id picks up the most recent value of the user field for a given search id.I wrote the code below after looking at many examples, and reviewing the modules documentation.Īnd yet, I can't get it to work. In order to drill down to the source of the problem, pick one example. ![]() The next step is simple: Compare the results generated by the search and its multiple evals against the source events. Run the search manually from the time line, in the relevant app contextĪnswer the question: Can you reproduce this manually, outside of the view it was reported in? For more info, see Expand your search in the Search Manual. This opens a preview that displays the expanded search string, including all search macros and saved searches. You can see the contents of your entire search by using a keyboard shortcut, Command+Shift+E (Mac OSX) or Control+Shift+E (Linux or Windows) from the Search bar in the Search page. ![]() ![]() For that reason, it is often easier to expand them manually so that you know exactly what your search is doing. Macros and event types are convenient knowledge objects, but unless you know exactly what they do, they can obscure the way a given search works. You can look at the view source by appending "?showsource=1" ("&showsource=1" if other parameters have already been appended) to the view URL in the browser address bar. Begin troubleshooting here.Äetermine the search string that powers the panel that is not showing the expected results You are using an app, and one of its views does not show you the results you expect. Dashboard in app is not showing the expected results ![]()
0 Comments
Leave a Reply. |