Improvements in some complex cases around back button usage, where subsequent custom interactions could be effectively ignored by upstream modules.
Fields module will no longer refresh if it sees known bad characters in the prefix the user has typed.
Fixed a bug where if a Tabs module was configured with purely dynamic tabs (rendered from search results), and no explicit selection, it would not default to showing the first tab selected.
Version 1.6.1 (November 3rd, 2023)
Fixed a bug in the Table module, where in some situations it failed to pass down drilldown tokens holding the values of its “hidden” fields.
Chart command, when using a “split by” field, will look for a particular token named .fieldOrder, and will reorder the data so that the legend items are rendered in that order.
Version 1.6 (November 1st, 2023)
Fixed a bug in the CheckboxPulldown, where if it was in “sticky” mode, it was unable to preserve selection values if they contained any space characters.
Fixed a bug in all timerange displays when describing timeranges shorter than a single minute. Headers and tooltip descriptions no longer erroneously display the minute as the timerange description, but rather the precise span of seconds involved.
Fixed a bug where nestable pattern tags could not have *direct* children that were also pattern tags.
Fixed a bug in the Report module, where in advanced “report builder” views, the optimization for ordering day-of-week fields would only work correctly if the xaxis field happened to be time.
Fixed a bug in advanced customJS drilldown scenarios, where the applyContext mechanism was being used to set complex sets of upstream form element selections generically. Previously such drilldown interactions would be unable to set keys that were not in the direct ancestor chain. Now the interactions are able to set or reset any form element configurations on the page.
Improved the custom jobstatus endpoint and related client code around the Splunk API, such that preview counts are available and module behavior is more suitable when preview is enabled on running searches.
App developers using a “shunt” endpoint so they can mix and match canary views and simple xml views in their app navigation, can now hardwire other qs args besides “views” and they will get passed along in the final “shunted” URI
Fixed a bug in the Table module around “cell” drilldown, concerning the advanced searchterm tokens, particularly in split-by cases within general report builder views.
Version 1.5.14 (September 7th, 2023)
Fixed a bug where if a report was saved in a view with a textfield, and the value saved into the textfield contained an html unsafe char like < or >, it would come out escaped when the report was run.
Version 1.5.13 (August 28th, 2023)
Fixed a bug where some form field modules wouldn’t work correctly if the selected value was “0”
Fixed a bug in the app navigation bars of all Canary apps where custom anchor links did not always work when in Simple XML’s edit mode.
Fixed a bug in advanced Table drilldown use cases when using the Report module and an “over none” option for the x‑axis
Version 1.5.12 (August 4th, 2023)
If Splunk returns an error that the search could not be dispatched because the user’s srchDiskQuota has been exceeded, Canary now treats this as an error and displays it to the user. (Splunk search treats this as INFO which makes it hard for the user to even find).
Fixed a bug where the Canary UI would display the product as “Splunk> enterprise” even when running in Splunk Cloud.
Fixed a bug where CheckboxPulldown’s “sticky” param would not be respected for dynamic option values and the previously saved selection state would be ignored.
Version 1.5.11 (April 28th, 2023)
Fixed a regression introduced in 1.5.9 where if you were using a custom cert on the splunk management port, all searches would fail in Canary views.
Fixed a bug where chart drilldowns with non-time X‑axis would reset the drilldown timerange to all time.
Version 1.5.10 (April 25th, 2023)
Fixed a bug in the ‘slightly improved job polling’ method implemented in Canary 1.5.7 that effectively negated that feature’s performance benefit whenever more than one search was running in the page concurrently.
Fixed a minor mistake in some sourcetype config that resulted in an error on splunk startup.
Version 1.5.9 (April 14th, 2023)
Fixed a bug across all of the form-element modules whereby sometimes in specific scenarios they would reset their selections to the value they had when the page first loaded in the browser.
Fixed a bug around the CheckboxPulldown and TimePicker modules where it was sometimes possible to have both menus open at the same time, with one potentially obscuring the other.
Fixed a bug in the Timeline module from when it was moved to Canary where its topmost header would display an incorrect timestamp instead of the relevant time unit label like “2023”
Version 1.5.8 (October 27th, 2022)
Added a new UI tool called “The Canarifier” that automates various busywork that app-owners need to do, if they ever want to make a particular app of theirs seamlessly switch between Canary views and non-canary views.
Fixed a bug in the ProgressIndicator module where while the job was still dispatching or was queued, some messaging was not displaying to reflect that status to the user. Instead the module was remaining blank until later when Canary had the first explicit job information return from our poller.
Version 1.5.7 (October 18th, 2022)
The Editor now will update its own top level URL when you change to a different app, view or mode, so that if the user hits reload it will actually reload in their current app, view and mode, instead of resetting to defaults.
Canary now does a slightly different mechanism for job polling that results in greatly improved UI performance for significant classes of searches.
the Editor UI no longer launches in a constrained popup window. It launches in a normal tab/window now.
Views are now cached which makes a small improvement to page load times. If you are editing views on disk or editing views not through the Sideview Editor, you should contact us.
AutoRefresh module now allows the “refreshEvery” param to be omitted, in which case it will reload the page as soon as it receives data from upstream.
Fields module will now remove a selected field if you click it again on the ‘available’ side.
Fixed a bug in the Fields module where if 2 or more of them were present on the page, they would sometimes interfere with eachother’s field-filtering controls.
Fixed a bug where if Splunk was restarted and then the first URL hit by the first user was a “shunt” URL, they would get an error that “LOG_FILE_PATH” was not defined.
Fixed a bug where the little icons to clear the contents of a param were not visible in the Editor since we changed from light bg to dark bg.
Fixed a bug in the Editor where if the user drove the preview window to another page (eg by testing drilldowns) the previous window would break until the Editor was reloaded manually.
Fixed a bug in the Editor that prevented the user from editing the properties of the view itself (eg label and isVisible etc).
Fixed a minor bug in the Editor that modules added to the top level would get their layoutPanel set to “viewHeader” instead of whatever the user specified.
Fixed a minor bug in the Pager module – in very horizontally constrained layouts the prev/next links would sometimes try and wrap to a second line.
Version 1.5.6 (September 1st, 2022)
TopNav module no longer offers a “logout” option when the Splunk Free license is being used.
Fixed a bug in the Sideview Editor where in “Runtime Debug” mode the display would not update when the developer interacted with the modules in the preview pane.
Table module now has a param “height” that can be set to a number of pixels (eg “400px”), in which case it will have a maximum height of 400px.
Fixed a bug that would arise if you used Multiplexed Multiplexers to dispatch searches. If you don’t know what that means then you aren’t having enough fun with Canary yet.
Version 1.5.5 (June 24th, 2022)
When a search has errors but they’re of a kind that splunk only includes on the jobs endpoint response – these are now picked up and displayed in the UI. Previously the Canary UI did pick up most errors, but only when they were returned either on the dispatch POST or on any of the results endpoints.
Canary now implements the convention used by other Sideview apps, where app navigation URI’s are to a special redirection endpoint. This fixes a class of bugs where navigating to a core Splunk view (like “search”) and then to back to a Canary view lands you on a broken page.
Report module now will detect if the xField is “hour_of_day” or “date_hour” and it will make sure all of the hours in [00,23] are represented in the table/chart.
Version 1.5.4 (May 27th, 2022)
Fixed a minor bug that caused pagetitles to render improperly sometimes when there were more than 30 apps installed.
Fixed a bug that affected some complex views that used PostProcess requests to render both their UI elements and their main results from the same underlying job.
Version 1.5.3 (May , 2022)
Fixed a regression that prevented Canary views from rendering on Splunk 7.3
Version 1.5.2 (May 5th, 2022)
Fixed a CSS problem that caused Table modules with complex multivalue cell drilldown to wiggle a little bit as different elements were moused over
Changes in the AppNav module to allow other code to trigger a reload of the savedsearches or saved dashboards list when appropriate.
Fixed a rare bug that seemed to affect a small number of Splunk Cloud deployments, that caused some redirects to the core “search” or “report” views to hang.
Version 1.5.1 (February 9th, 2021)
Fixed a problem introduced in 1.5 where in many cases users would end up on the wrong URL’s and get 404 errors. The root cause was that the AppNav module was not correctly following Canary’s conventions around “shunt” endpoints.
Version 1.5 (February 4th, 2022)
Search errors encountered by any modules while the search is running or when the search completes will now propagate out to the Canary UI by default.
Performance improvements under the hood for pages that dispatch several searches at the same time
Pattern tags can now be given param tags, and the values will be mapped to corresponding <outerparam> nodes in the pattern’s definition
Link module now has an alternate mode where it acts as a toggling show/hide control for the modules downstream. In this mode it is styled as an expandable/collapsible drawer control.
In custom reporting interfaces, when the user sets a numeric x‑axis fields (the numeric nature being inferred by presence of a visible binning control upstream), now are piped through makecontinuous if there is no binning value set. The purpose of this is to remove the confusing gaps in the x‑axis values.
Fixed a small bug where tooltips on timecharts with second granularity would not actually show second values.
Fixed a bug where Button and Link modules in some complex scenarios would become confused, think the page was still loading and fail to push changes to downstream modules when clicked.
Version 1.4.11 (November 11th, 2021)
Improvements to the Report module. It will now generate a report when the xField is null, ie when there is no ‘group by’ field. It will also do so when there is no xField but there is a split-by field.
Fixed a bug in the Chart module, where in some cases it would begin the y‑axis at a non-zero number.
Fixed a rare bug in Pulldown – if you had a null option in staticFields, and it wasn’t the first option listed but you wanted it to be selected, the module would previously refuse to select it on page load.
Fixed a bug where subsearch truncation warnings were not displayed in the Canary UI.
Version 1.4.10 (October 6th, 2021)
Fixed an obscure bug in CheckboxPulldown. When it was processing clicks coming from downstream from interactive modules like Tables, it would update visually to remove the old selection but it would keep outputting the searchterm for it.
Fixed a minor bug that when ProgressIndicator modules were Multiplexed they would render an extra copy of their internal HTML
Improvement to the Fields module – when the layer is opened the textbox to filter available fields is now selected by default so the user can just go straight to searching for fields they want to add.
Improvements to the Events module. Fixing the softWrap support, timestamp rendering, field/value clicking.
Version 1.4.9 (August 25th, 2021)
Improved the Chart module’s tooltips in timechart cases so that it now lists a readable description of the start and endtime. Formerly it only displayed the string formatted start time.
Improved the display of timeranges such that when the timerange is a single day or a single month, it will display more compactly as “August 23rd2021”, or “August 2021”.
Moved over the “violation predictor” alert from the old Sideview Admin Tools app, as this should have been added to Canary when the “License Monitor” dashboard was added. They were designed to work together.
Fixed a bug in the TimePicker where if you used the “All Time” timerange, previously the preference that would get saved would leave the latest=now key from your prior timerange preference, thus inadvertently filtering out any events that happened to be timestamped slightly in the future.
Sideview Editor now correctly returns an error if a user in Add or Reattach mode tries to make any module a child of a module that has set “forbidsDownstreamModules” to true in its conf.
Version 1.4.8 (August 5th, 2021)
Fixed a bug in the CheckboxPulldown module where if selectAllOptimization is set to “*”, the module would sometimes select all options unexpectedly when an upstream change was made.
Fixed a bug in the TimePicker module where if URLLoader had keepURLUpdated set to True then changes upstream from a TimePicker module would reset the TimePicker from the “soft querystring” value aka the hash querystring value back to what it had been on the initial pageload.
Version 1.4.7 (August 3rd, 2021)
Fixed a bug that prevented Canary views from working when the logged-in user had a space in their username.
Version 1.4.6 (June 29th, 2021)
Brought over the “License Monitor” view that was previously in Sideview Admin Tools and made sure it works with Canary
Fixed a bug in the Table module where it was impossible to sort the results by time, ie by the “time” field.
Fixed a bug in the TimePicker module’s Custom Date/Time mode, where if you set only the earliest or latest side, it would display an error and fail to run. Now one-ended timeranges are properly supported.
Search module’s “clearPostProcess” param now works properly
Fixed a bug in the Table module where it would only write the “click.selectedTableName” key to the context if drilldown was in “cell” mode.
HTML and Radio modules now have float and clear params.
Improved behavior of the Pulldown module’s little green progress bar, when several Pulldowns are used consecutively, rendering data from the same job.
Fixed a bug where the UI could freeze when certain permalinks were loaded, in views that had different modules rendering in separate tabs under a Tabs module.
Improved behavior in some unusual cases where modules or customBehavior code was dealing with the specific field name “name”.
Version 1.4.5 (April 15th, 2021)
Fixed a regression introduced in version 1.4 in the Report module. The bug was that if your view was using the binning options then the module would fail to mvexpand multivalue rows before the bin. This could result in a confusing mix of some binned values and some unbinned values in the final reports.
Version 1.4.4 (April 8th, 2021)
Fixed a bug in how Redirector handled generic drilldown where it would fail to overwrite values set by upstream form elements when appropriate with the value from the clicked upon chart element.
Resolved a minor bug where Link modules that only had one child that was a Redirector module would not listen to the popup=”true” param on the Redirector when clicked.
Resolved a minor bug where the Table module’s new drilldown=”cell” mode didn’t properly escape the main $row.cell.value$ key for use within the search language.
Resolved a minor bug where if your app didn’t specify a “label” in the [ui] stanza in app.conf, the app would be listed as “None” in the app menu, and “None” would appear on the right hand side of the AppNav module.
Version 1.4.3 (March 24th, 2021)
Fixed a bug introduced in Canary 1.4 affecting the table module. In advanced “table embedding” configurations the Table could end up displaying the wrong field values in the table columns.
Resolved a bug where contextual action menus would show up underneath charts if “line”, or “bar” charts were selected. Menus now appear on the marker or bar that the user clicks.
Version 1.4.2 (March 11th, 2021)
Canary modules including the Chart and TimePicker modules now always display and interpret times consistently in the user’s preferred timezone preference (or splunk system TZ if no preference exists), rather than their browser’s local timezone.
Canary now has a “FreshMaker” view just like Sideview Utils. Developers can use this view to reload certain Splunk configurations from disk without a restart.
Fixed a bug where the TimePicker module would often later start displaying “custom relative range” when you had selected some of the preset ranges in its menus
Fixed a bug in the TimePicker module’s calendar picker where the ‘next month’ and ‘previous month’ images were not visible
If a developer picks a layoutPanel that exceeds the maximum number of rows or columns allowed, there is now an informative error message displayed on the page. Also those limits are raised from 10 columns to 20, and from 50 rows to 100.
Version 1.4.1 (March 3rd, 2021)
Fixed an issue where saved preferences from canary modules can later trigger warnings from btool’s config validation when Splunk is restarted. There was no actual harm in the config as it existed in 1.4 so this fix effectively just makes the btool warnings go away. If you don’t mind a few warnings on startup there’s no need to update to this release.
Version 1.4 (February 24th, 2021)
Table module’s “drilldown” param is no longer a prototype. This can be set to “cell” and downstream modules will have access to the field name and field value of the clicked-upon cell. When configured in this way, individual multivalue values can be moused over and clicked with the drilldown passing only that single value.
Chart modules now pass information about the last element clicked downstream so that downstream modules like Layer can align themselves to it for things like action menus and modal popups.
CheckboxPulldown now has an optional pulldown called “sticky”. When set to True, it will push and pull its selection state to/from user prefs. The preference is scoped by app, view name and the “name” param of the CheckboxPulldown. When set in this way, the selected flags in the staticOptions param become effectively the default preference for new users.
Fixed a bug in the Fields module where if you had more than one of them on a page, they would attempt to load and set their preferences to the same key in ui-prefs, such that the last one to get set would set the field list for all of them.
Fixed a bug where if the user tried to navigate in the App Nav to one of their HTML dashboard views, they would get an error instead of an appropriate redirect to the right splunk url to load the dashboard.
Individual modules can now have multiple customBehaviors that apply, by comma-separating the list of customBehavior names.
Fixed a bug where customBehavior code was not running for multiplexed or table-embedded modules.
Fixed a bug in CheckboxPulldown where emptystring values would not get prepopulated correctly in certain cases
Fixed a bug in the Report module (used in complex general report generation pages) where if you let the end user “bin” their primary axis field or splitby field, and some values were null coming into the report, it would give you weird “VALUE” columns in the final output instead of just “NULL”.
Fixed a subtle bug in the Redirector module where it was passing on emptystring args in the uri for keys that didn’t exist at all in the original page’s context data. This was having a side effect of preselecting emptystring values in CheckboxPulldown modules in the target page
Fixed alignment bugs in the Layer module that made it often render wider than necessary.
Version 1.3.11 (January 15th, 2021)
Fixed a bug in the AppNav module where if you clicked on a “Saved Report” that had actually been saved in the Canary UI, it would load it in the default Splunk search UI.
Improved behavior in the AppNav module, where if the app navigation is configured with direct <a> tags instead of <view> tags (and if the uri in the anchor tag is a canary “shunt” uri), that the module will skip over the link if the current user doesn’t have permission to view the page. Prior to this release lower privilege users would get such links rendered in the nav but the link would load only an error when clicked.
Chart module now supports pie charts.
Fields module now will look for a field called “label” and if it is present, it will label the field with that string instead of the “field” value. This allows app developers to specify custom informative labels for fields directly in the SPL used to source the field names for the Fields module.
fixed a minor bug where if an app’s default.xml didn’t have a view with default=”true” it would lead to an exception when navigating to the app from the apps menu.
Version 1.3.10 (November 12th, 2020)
Fixed a regression from the 1.3.9 root_endpoint changes, where the URL’s to your saved reports, in the AppNav module’s navigation bar, didn’t work.
Version 1.3.9 (November 6th, 2020)
More fixes for deployments using root_endpoint config. saved search links in the app navigation bar are now fixed, and if you put the “search” view in your app nav explicitly the link will redirect appropriately now.
Version 1.3.8 (October 16th, 2020)
Fixed a bug where some modules were making requests without considering whether “ROOT_ENDPOINT” was set in web.conf. This would result in pages not loading and working properly when Splunk was set up in a reverse proxy configuration.
Version 1.3.7 (October 7th, 2020)
Fixed a bug where users of Edge or Chrome, when exporting search results with the SearchControls module, wouldn’t get the “csv” extension added to the filename in the save-as dialog
Fixed a mistake in module_gallery.csv that was generating a very verbose WARN in the _internal index on some deployments, about the lookup having an illegal field name of “”.
Version 1.3.6 (August 26th, 2020)
Fixed a somewhat hard to hit bug involving 401 redirect and/or a redirect loop. Fix is to slightly alter the REST call that Canary uses to get the current httpport and root_endpoint config. Root cause appears to be incorrect behavior in Splunk’s rest api in /services/configs/conf-web/settings, and confusing behavior in /servicesNS/nobody/-/configs/conf-web/settings. The app now gets the config from /services/properties/web/settings/*.
Fixed a bug that could prevent Canary from loading previously saved reports when users clicked on them in “saved reports” menus.
Fields module now has a “clear all” link above the selected field list and an “add all” link above the available field list.
Version 1.3.5 (August 18th, 2020)
More work improving the overall system of how a “canary app” is supposed to be implemented so that no matter whether a user is in Splunk7 or Splunk8, or whether they’re in a Canary view or a default splunk view, or a Sideview Utils view, that they can click on links in the app’s navbar and end up in the right places, and they can click on the links in the app menu and end up on the right URI for that app’s landing page.
Canary homepage now explicitly uses splunk_server=local on it’s usage of the splunk rest command. Previously it seems we had relied on our users not having the “dispatch_rest_to_indexers” capability, because in that case Splunk falls back to only dispatching against the local SH.
Improvements to what you can have in legacy Sideview views, but still have Canary autoconvert the view and render it without complaint
If config is encountered where a module that isn’t supposed to have child modules, has some nevertheless, it is moved up alongside its former parent during autoconversion. Previously this blocked conversion.
leading or trailing spaces on module names are removed quietly
vestigial “groupLabel” attributes are removed
group attributes not set on Switcher modules now log a warning – the old default panel headers are gone
previously forgiven casing mistakes on useHistory param and allowSoftSubmit params are now corrected to True/False
drilldownPrefix param from advanced SimpleResultsTable config is now converted to Table and its optional “name” param
Pages who had (bravely) use the old JobSpinner module are now switched to using ProgressIndicator
Version 1.3.4 (August 2nd, 2020)
Fixing a regression introduced in 1.3.3’s Canary nav/homepage redirection improvements, where if the user went to Canary *itself* unfortunately the homepage would say “Loading Canary” but nothing would ever change.
The “view the XML source for this view” links, on most docs/examples leaf pages, now work properly. Previously they were still trying to leverage an old controller in Sideview Utils which would then only work on older versions of Splunk. Now they just hit the view endpoint in Canary to do the same job.
Improving the TopNav module’s App switcher pulldown, so that if the given app is a Canary app using the new “home_redirect” convention, it just skips the redirect (since the Canary UI implicitly knows Canary is installed) and goes right to “home”
Version 1.3.3 (July 31st, 2020)
Table module now supports the sparkline() function in the SPL reporting commands. Specifically the module will render a little sparkline pretty much just how the Sideview Utils table module did in the Sideview XMLUI and how the legacy Splunk ui modules did back in the Advanced XMLUI.
Fixed a regression on pages that used the Tabs module, on older Splunk versions – the fix on 7⁄23 just ended up trading one error for another unfortunately but it is now fixed.
Views marked with isVisible=”false” are no longer listed in the collection nodes in the app navigation.
Views listed explicitly in the app navigation are no longer listed again under “saved dashboards”
As a part of our work to eliminate Sideview Utils as a dependency on Splunk 8 and up, Canary apps can now have URLs that look like ../../splunkd/__raw/services/_shunt?view=, and a) the Canary UI will rewrite the nav link to be just a simple link to that view in canary. b) in splunk’s default UI pages, if the app ships a controller at that given path, the app can then return 301’s as necessary to redirect the user to the Canary URI, or variously to redirect the user to help pages if Canary is missing or if there are any other missing dependencies.
As another part of our workaround to eliminate SVU as a dependency, Canary apps can now have a simple xml view called “home_redirect” that when loaded, will have JS to redirect to the shunt endpoint (see above), but when loaded in the Canary UI, the nav will render the corresponding canary URI to the “home” view.
Version 1.3.2 (July 23rd, 2020)
Fixed a bug that affected some earlier Splunk 7.X versions, where any pages using the Tabs module would error out with “ImportError no module named six”.
Improved the homepage reports to properly differentiate internal splunk backbone views from “HTML dashboard” views. Also improved exception handling if XML views are encountered that have explicit encoding declarations.
Version 1.3.1 (June 10th, 2020)
Fixed a bug where if you were port forwarding the SplunkWeb port, you would get CSRF validation failures when submitting certain kinds of forms, notably any change or new view submitted in the Sideview Editor.
Added some simple support for “*_grp” suffixed layoutPanels, which was a feature of the Advanced XML and thus of Sideview XML. These represented a strange part of the old Advanced XML and that I had hoped to do without in the new world. However on further review this was pretty commonly used and the “workaround” of recreating this kind of custom layout with custom CSS is quite tedious.
Fixed a bug in the Redirector module where the “mergeDrilldownKeys” param was always being treated as True. This had some confusing effects for instance in a Table drilldown config, where a form element on the target view happened to have the same name as a field value in the row being clicked on – the drilldown would mysteriously pass on the value of the field value, rather than the value of any upstream selection.
Fixed a bug where any view that dispatched no searches at all would suffer a strange effect where the user could change the selections of your form element modules, but their changes would be ignored.
A minor change to pull the app version dynamically for the HTML on the homepage, so we don’t have to manually update it any more.
Improved migration cases around usage of Splunk’s old HiddenSavedSearch module, migrating this to the new SavedSearch module. Also some other migration improvements to a few other module params and values
logging improvements to canary.log, to log more details and to do it more consistently.
Version 1.3 (May 6th, 2020)
SearchControls module – Fixed a bug where CSV export was limited to 100 rows
Topnav module – Fixed a regression where if a user had not entered their full name in their account page in Splunk, the TopNav wouldn’t display anything at all. Fixed so in such a case it displays their username again
Report module – added a strange but useful feature so that if any custom report builder is using this module to put together the final stats/chart/timechart determination, and the primary ‘group by’ field is date_wday or day_of_week, it actually sorts them into the right order. Similarly if the split-by field is either of those it orders the columns into the right order.
TextField module now has a “clear” param, like the other form-element modules
TextField module now has a “type” param that you can set to “password”. Although this is an unusual case, sometimes the module is used in admin/setup pages and the user might be entering a credential for their app’s custom data input.
Button module now accepts a “float” param and a “clear” param, much like other form-element modules.
views can now pass a querystring argument named “sideview.message.info”, (or ending in .error, .warn) and the message will be displayed at the top of the page.
ValueSetter module improvement – if you are setting multiple conditional rules you no longer need to specify explicit priority flags on them, and instead they will just get run in document order.
Search module now has a param ‘clearPostProcess’ that defaults to “True”. This is technically a change to behavior, but it will only affect some strange configurations that we dont’ seem to have ever had arise in our apps. It also has the great benefit of eliminating the need for ‘null postprocess’ modules that are just there to clear away some upstream postprocess value. If anyone ever wants to turn this behavior back to the unsafe way, they can set this new param to “False”.
Chart module – fixed a bug where if you were suppressed the display of X‑axis labels by setting the key charting.axisLabelsX.axisVisibility to “hide”, it would also make the tooltips show epochtime integers instead of string-formatted times.
Chart module now has an optional “width” param that defaults to “100%”, as well as “float” and “clear” params
Table module – now has an optional prototype param called”drilldown” that can be set to “cell” (the default is “row” and represents the to-date largely automatic row-drilldown functionality). This “cell” value is prototype functionality at the moment and behavior may well be subject to change in the near future. The goal is to enable a much broader range of custom drilldowns including custom menus and custom redirect options (with the Layer module) without the need for custom JS.
Version 1.2.6 (April 10th, 2020)
Chart module now supports the old Splunk charting keys “charting.axisY.minimumNumber” and “charting.axisY.minimumNumber”. When set, the given value will be used as a minimum or maximum value of the y‑axis range. Notably though if the actual data being charted exceeds the maximum or is less than the minimum, then as implemented here the setting is ignored.
Chart module now supports the old Splunk charting key of “charting.axisLabelsX.axisVisibility”, which can be set to “hide” to hide the x‑axis labels and tick marks entirely.
Version 1.2.5 (April 3rd, 2020)
Fixed a bug where if your custom app didn’t have an application.js file in appserver/static, that Canary views in the app would not load
Improvements to make various arrow icons consistent across navigation menus and form element controls.
Improvement to the Chart module – When you mouse over items on the legend, for line charts and area charts the little point markers animate up in size to make it clear which series you’ve moused over. Mousing away from them they animate back to their default size.
Improvement to the Chart module – the ‘breathing room’ fix made to the logarithmic y‑axis in 1.2.3, now uses 3x instead of 2x.
Added some logging so that if you hit a certain kind of fatal mako error in a custom mako template, it logs out the error and stack trace to canary.log (Side Note: Canary ships its own copy of mako, so this is not using the Splunk one in any way).
Fixed a bug that has been here quite a long time, where clicking the “manage apps” link in the TopNav module’s App menu (generally in the top left of pages), would take you to the landing page of the last app in the menu, instead of to the manage apps page.
Improvement to the Chart module – the ‘breathing room’ fix made to the logarithmic y‑axis in 1.2.3, now uses 3x instead of 2x.
Fixed a bug where if you were building Canary views in an app that didn’t have the “version” key in the [launcher] stanza, or the “build” key in the [install] stanza, that the views would just render a somewhat indecipherable python stack trace for the KeyError
Version 1.2.4 (April 1st, 2020)
Fixed a bug in the URLLoader, where saved searches and reports that had been saved in canary views, would fail to load properly when selected from the Reports menu, if they had spaces or non-alphanumeric characters in their names.
Fixed a bug that would happen when the user tried to load saved searches and saved reports that were saved from the generic Splunk search pages, but within canary apps. Formerly the user would end up on the generic “search” or “report” view in the Splunk UI, but with a ?search.name=foo querystring argument that was ignored by that page.
saved searches saved with no ‘displayview’ property set at all are now loaded in the ‘report’ view. This is a change from previous Canary and Sideview Utils conventions where such savedsearch links would take the user to the “search” view.
Fixed a bug in the TextField module, where in certain view configurations it might fail to pass on its value to $foo$ tokens downstream. This defect was always there, however the effects were mostly or entirely masked and mitigated by the erroneous page-loading behavior that was fixed in 1.2 last week (see below).
Added a feature to the Pulldown module whereby it can receive directive keys from upstream that tell it to disable/enable particular options, or to show/hide itself entirely.
improvements to the Chart module, to make it render smaller Legend items when ther are more than 50, and to make it hide the legend entirely if ever there are more than 100
Version 1.2.3 (March 29th, 2020)
Improved the behavior of the logarithmic axis, to automatically give some breathing room, by specifying a max y‑axis value that is twice as high as the highest point (remember – logarithmic scale, so 2x is only “a bit more”).
Fixed a bug in the CheckboxPulldown, Checkboxes and Radio modules where if only the postprocess search from upstream changed, these modules would not realize that they needed to reload their options.
Version 1.2.2 (March 24th2020)
Updated the version of the multiselect library used under the hood for the CheckboxPulldown module. The specific bug this resolved was that the module could not support values that contain double-quote characters.
The Chart module now supports a “charting.seriesColors” key that can be passed to it, that is a comma-separated list of hexcolors. It will use the given colors to denote the colors of the various series being charted.
Some defaults changed in the Chart module for when only 2, 3, 4 or 5 series values are present. Previously the module had a tendency to put yellows and oranges next to eachother.
Version 1.2.1 (March 22nd2020)
Fixed a bug in the Chart module where if you changed the chart type and then moused over elements in the new chart in the right way, you could get the old chart to reappear, and the two charts to even flicker back and forth.
on receiving a 401 response from Splunk, Canary views now redirect to the Splunk login page.
Turning the Chart modules bezier curve feature way down so the lines are almost straight by default. Although the default beziers are pretty they can mislead/confuse users in some charts where the curvature displayed was then impossible in the real data.
Version 1.2 (March 21st2020)
Cleanup of some significant inefficiencies in how modules were initialized on the page. Pages will load significantly faster now, even though they were already loading significantly faster than Splunk views.
Turning the Chart modules bezier curve feature way down so the lines are almost straight.
Version 1.1.4 (March 19th2020)
CheckboxPulldown and Checkboxes modules now have a selectedCount $foo$ token that they output that represents the number of items currently selected. This is useful for contextual messages downstream.
Chart module now supports the “legend.position” charting key. Values can be left, right, top,bottom. The default is “right”.
Fix for a regression in the Table module from a bugfix in 1.1.2 – that fix did indeed keep the “time” field from vanishing in some cases, but at the price of moving it’s order in the columns to the end in some other cases. Fixed and these cases are now covered by additional unit testing.
Version 1.1.3 (March 17th2020)
Chart module now supports nullValueMode set to “connect”.
Chart module now wont draw the second level of time axis labels diagonally. This means multiple charts presented on the same page will have consistent height and more consistent legend layouts.
Fixed some longstanding peculiarities in page layout when Chart modules are Multiplex’ed.
Version 1.1.2 (March 16th, 2020)
Added support for a logarithmic y‑axis to the Chart module.
Added a feature to the Chart module where if it sees the “sideview.xField” and “sideview.yField” keys coming down from upstream, it will use those strings as axis labels on the rendered chart. Note this is splunk’s “x” and “y” convention and that in bar charts specifically, it’s opposite of what you might expect.
Changed the line chart type in the Chart module to ignore “stackMode” so it can never be stacked even by accident
Shrank the default marker size on the line charts in the Chart module
Fixed a problem where if there was an syntax error or a search execution error that the parser could not see during the dispatch, the framework code was not taking appropriate responsibility to fish those errors out of getResults responses and broadcast the error message to the page
Fixed a problem in the Table module where sometimes it would fail to output the “time” field.
Increased the default height of the CheckboxPulldown module’s layer
Version 1.1.1 (February 28th, 2020)
Licensing change – Canary is now distributed under the Sideview Free Internal Use License. Therefore 90 day trial license strings, and license strings of any kind no longer have to be entered anywhere before you can use the app.
Added links in the topnav to the Job manager and to the Alerts page
Fixed a bug where dispatching a new search at a given point in a given view, would not automatically cancel the previous ad-hoc job dispatched at that point.
Fixed a bug where pages with very wide modules – eg tables with lots of columns, could force the content partly offscreen right with a scrollbar, and unfortunately also partly offscreen left where it could never be seen.
A small improvement eliminating the “services” segment from the top level canary page URL’s visible in the user’s browser.
A change to actually force Canary’s restmap.conf endpoints to run in python3
A fix to make Canary more forgiving if older customBehavior code is used, that uses older conventions around the onContextChange method. Now it will nag in the console, but provide the old behavior so there’s no exception thrown.
Corrected some confusion in the warnings when we automigrate the legacy FieldPicker module to the new Fields module.
Fixed a bug that disrupted modules downstream from Switcher modules from rendering results if the Switcher was using a job token as its selectedGroup property.
If the current user’s full name is not set, the top nav now displays their userid instead of nothing.
Fixed a bug whereby if you went to the URI for an app that wasn’t even installed, it would give you a misleading 404 error about the view, instead of saying the whole app itself didn’t seem to be installed.
Fixed a one line mistake in the Editor’s POST logic if we were running in Python3.
Version 1.1 (February 13th, 2020)
There is now a full featured authoring interface where users and administrators can edit and create new Canary views without reading or writing the XML or yaml of the raw file format.
SavedSearch module now fully implemented and usable. has a ‘useHistory’ param that can be set to Auto, True or False (Auto being the default). Auto/True will load jobs created by the scheduler if any exist. It broadcasts errors as appropriate to these cases and will also return any context keys saved into the savedsearch entity’s custom request.ui_context property.
Fixed a bug where choices and selections that had become invalid would get passed downstream. This was easiest to notice in views that had two or more Pulldowns chained together.
Fixed a rare bug in the AppNav module – if a custom app included an anchor elements in its default.xml navigation file, where the href began with “../../manager/” – this uri would lead to a 404. Now it works as it did in the old Splunk UI and takes the user to the given manager page when clicked.
Fixed a bug in the AppNav module where if an app included and nodes inside its default.xml file, the rendered order of all the links wouldn’t necessarily match the expected order from default.xml.
Canary now has a slightly different implementation of the FreshMaker UI relative to the Sideview Utils app, although for now it still relies on the old web.conf controller over in Sideview Utils.
Fixed a hard-to-hit bug in the Redirector module that would only apply if you had some args in the URL and also other dynamic args specified in arg.* params.
the SearchControls module’s ‘cancel’ button will no longer allow the user to cancel jobs that were created by the Splunk scheduler. Instead a message is displayed directing them to Activity-Jobs.
Version 1.0.7 (January 16th, 2020)
Fixed a problem where clicks to Simple XML dashboards, or HTML dashboards like the “search” view wouldn’t redirect properly and the user would end up on the wrong URL with a confusing “response has no payload” error.
Improvement in error handling to propagate the actual error string out to the user
Fixed a bug that only seems to occur on Chrome whereby clicks on the “export” icon would fail and land you on a page saying “Unknown sid”.
Version 1.0.6 (January 10th, 2020)
Fixed a regression in TimePicker introduced only in 1.0.5 (released yesterday), where pages would hang if a TimePicker received a push from upstream modules while it was still waiting for the global page preferences to load.
Version 1.0.5 (January 9th, 2020)
Fixed a bug in the TimePicker where when the page loaded the first search dispatched would in some specific scenarios ignore the TimePicker’s selection entirely and run an all time search instead
Fixed a bug in the TimePicker where the absolute time picker aka the “custom time” mode’s little calendar widgets wasn’t working properly
Improvement to the TimePicker so that when you are in “custom time” and you have a calendar widget open, the widget no longer obscures the layers overall ‘apply’ and ‘cancel’ buttons.
Fixed bugs where the cancel button and some other buttons in the SearchControl modules did not work properly, and where HTML and ProgressIndicator modules would not reset when their jobs were cancelled.
the Apps menu in the TopNav module now has a “Manage Apps” link.
Fixed a bug in the Table module where if you sorted by a particular column and then went to a different page it would lose the sort order.
Version 1.0.4 (December 11th, 2019)
Error messages such as SPL parse failures are now propagated back to the end user properly. Formerly it would display an error saying “received 200 on a dispatch POST but no sid”.
Fixed a bug in the Fields module where if you made some changes and then didn’t commit them, the uncommitted list of selected fields would still be there if you closed and reopened the layer.
Fixed the ‘inspect job’ link in the SearchControls module in 8.0 (the URL to the Job Inspector actually changes in 8.0)
Improved the Table module to have an optional ‘hiddenFields’ param. If set, the given fields will always be prepended to the user’s selected field list. Also when the legacy FieldPicker module is migrated to the Fields module it inserts a “_time” field using this param, as that makes the Fields module match the old FieldPicker’s default behavior.
Change to the Table module to trim off “.000” from the end of displayed timestamps wherever present.
Change to the Table module to not display times in a 24 hour clock, and then redundantly display AM/PM also
Fixed a bug in the TimePicker module where the calendar widgets arrow controls to move forward or backward by a month, were invisible.
in Pulldown modules that have custom logic to disable/enable particular options, the text label of those options now correctly displays in a greyed out color
Canary UI now generates an error message for any users that try to load views in Internet Explorer, to the effect that the browser is not supported.
Version 1.0.3 (November 22nd, 2019)
Canary UI now supports the use of the “root_endpoint” key in web.conf. This key is commonly used in SSO configurations as well as in advanced configurations where more than one splunk instance or more broadly when more than one web application needs to be accessible on a single host and port.
Fixed a bug in the Chart module where it could throw an exception particularly on non-previewable jobs and fail to render.
Fixed a python3 syntax error in the “checkxml” command that would make the command fail if it encountered a broad range of view misconfigurations.
Version 1.0.2 (November 12th2019)
Resolved a major issue where if users were accessing splunkWeb through a local port that differed from the httpport configured in web.conf (as is common when proxies or ssh tunnels are involved), that many requests would fail CSRF validation and receive a 401 error when attempting to dispatch searches or POST to any endpoint.
customBehavior code (in custom apps) that tries to create an intance of the legacy Splunk.Search class will now end up with an instance of Canary’s SplunkSearch class instead. For most simple common tasks, this will give equivalent functionality.
Version 1.0.1 (November 2019)
Fixed a bug where the page title had “None” where the app’s name should be.
Fixed a bug in the Fields module where if you reordered a field in the selected field list, it would remove the field entirely.
Fixed a class of bugs that would happen in some complex configurations, where modules would end up with stale values downstream.
Fixed a bug where the Pulldown module was accidentally pushing downstream twice, causing an extra cancel and redispatch and other confusing behavior and slowness.
Fixed a bug where the Report module, when given input to create a timechart and when given an explicit bins argument for the primary axis, it would ignore the bins argument.
Fixed a bug in the Pulldown module where customBehaviors were unable to explicitly select the emptystring option within the control.
Added postProcess support to the Fields module
Resolved a bug in the Fields module where if you had multiple instances on a page, the filter-as-you-type search field would only work for one of them.
Version 1.0 (October 21st2019)
logged in user name is now the users full name instead of the username
Significant improvements to page rendering speed
SearchControls module now has an ‘export’ button again
Fixed a bug where any attempts to save a job would fail and the job would be paused instead
Fixed a bug where the search command to check views for canary compatibility would trip up on any views using the new patterns.
Version 0.9 (October 15th2019)
There is now an implementation of “ui patterns”. Chunks of view config can be saved in appserver/patterns and then loaded into views by referencing just the pattern name. This allows view developers to avoid repetition and to keep their views compact and easier to maintain.
Fixed a bug in the Chart module where the number of points on the primary axis (x‑axis) was being cut off at 100.
Found and fixed a directory traversal bug in the HTML module’s “src” param.
Version 0.8.1 (October 9th2019)
Fixed bugs where some modules might fail to remember selection preferences, due to ui-prefs.conf.spec having been mistakenly omitted from README subdirectory
Added some logic to enforce a minimum required version number for specific apps like Cisco CDR, so users dont accidentally do compatibility testing with versions that are simply too old.
Version 0.8 (October 7th2019)
Look and Feel:
New colors, styling and better alignment for form element modules.
Changed the button styles, tab styles and many CSS improvements.
form element modules in viewHeader and mainSearchControls layoutPanels are now floated left by default.
Fixed a bug in the Button module where allowAutoSubmit=False was erroneously allowing execution to proceed to the downstream modules during page load.
Fixed a bug in Table module around time-based drilldowns.
Fixed a bug in Link module where if it was being multiplexed it would end up with two copies of its actual link element.
Fixed a bug in the Timeline module where it would not render at all if the job finished extremely quickly.
SplunkSearch.dispatch was calling abandonJob which meant the properties that were just set like statusBuckets and requiredFields were being thrown away.
Fixed a bug in TextField where if you had rows set to 2 or higher, it would throw an exception if you had no label set.
Greatly improved performance of checking many jobs for progress concurrently.
TimePicker – Addressed race conditions in the TimePicker module between the ui-prefs.conf loading and the times.conf loading, and timeRanges arriving from upstream config (eg from the URL).
TimePicker – Fixed some bugs in the handling of the “label” param.
TimePicker – Fixed some defects in the menu code
TimePicker – Fixed a bug in how label elements are handled when migrating TimeRangePicker usage to TimePicker,
Updated the Button module so that if allowAutoSubmit is set to False, it hides its downstream modules when the page loads (its cousin the Link module already did this).
Fixed an assertion that wasn’t firing when we automatically migrate legacy Sideview XML views. It now errors out with a detailed error message if it encounters a module that has downstream modules, but is of a class that isn’t supposed to ever have them.
Updated the implementation of our standard app-licensing endpoint, so that now any admin that has the “edit_license” capability can update or create the app’s license string. Formerly the license string could only be updated in the UI by users who had the “admin_all_objects” capability.
Fields module, when it’s modal layer is open, now has a textfield users can use to filter the list of available fields.
Giving the AppNav module a pair of params to control whether savedsearches and dashboards from other apps should be rendered into this app’s saved search menu. These other apps may have decided to export their content to the “system” space but this doesn’t mean we want them in our menus here. Both new params default to False, ie they exclude globally exported content from other apps from appearing in the saved report and saved dashboard menus.
Some work to improve how the UI picks up the locale from the page URL and reuses that locale for all requests.
if anything sets a $foo$ token $shared.tz$ to the name of a specific timezone, then any searches dispatched downstream from that point will be dispatched with that tz, overriding the current user’s preference.
If there are still searches running when the user closes the browser window and they’re not marked as “saved”, we now try to cancel them explicitly.
Switcher module is now able to key off of any of the standard job keys that are published to the context.
Version 0.7.2 (September 19th, 2019)
URL’s to static files not properly incorporate the app version number and build numbers, so as to effectively defeat local browser caches whenever the app is updated (as long as splunk is restarted or the persistent rest handler that serves the views is restarted).
Version 0.7.1 (September 14th, 2019)
Many cosmetic fixes
AppNav module tries to make app developers life easier by at least logging an error if the nav explicitly specifies a view that the current user cannot see.
some bugs fixed in the code that converted the view config to the yaml format, that had been erroneously putting some redundant keys back in.
Chart module has new improved chart colors for all cases where there are fewer than 7 series
Fixed a bug in the Fields module where the available fields list would not render if you opened the layer before they were available.
Fields module and TimePicker module now save and load the user’s preferences from/to ui-prefs.conf
Fields module now has a ‘reset to default’ link that can reset the user’s selected fields.
Fixed a bug where multiple modules that used menu-ing systems, like AppNav, TopNav and TimePicker, could have their menus open at the same time.
Fixed a small bug in the Table module where trying to select the name of a column header would sort by that column.
TimePicker module’s “Custom” mode now works with URLLoader when latter is in ‘keepURLUpdated’ mode.
Fixing the Chart module’s rendering when each timechart bucket is just one second or a few seconds.
Version 0.7 (September 9th, 2019)
Changing default sort order in the Table module to be descending
Improvement to the shared menu code so the last-opened submenu doesn’t stick open while you’re mousing around.
Ported over the hideOnEmpty param for CheckboxPulldown which had been added to Sideview Utils in the past year.
Improved tooltip positioning and design in the Chart module when there is a split-by field.
Fields module now saves and loads the users current selected fields to/from ui-prefs.conf
Improvements to how things work as the user clicks around from Simple XML views to HTML dashboard views, to canary views, in the app nav bar
Fixed some general module loading logic that was preventing the Link and Button module’s “allowAutoSubmit” params from working.
Quite a lot of small compatibility fixes for when an admin has set Splunk Enterprise 8.0 to run all apps in python3.
Fixed a bug in TimePicker where it would erroneously push changes downstream when you opened the “Custom” modal popup.
Fixed a bug in some advanced Multiplexer cases.
Fixed file encoding issues with a couple third party libraries that were causing breakage on Python3
Removed last usage of the Splunk Python SDK
Fixed various problems in the Sideview licensing endpoint when run in Python3.
Version 0.6.1 (August 28th, 2019)
TopNav module now has a link to the Admin section landing page.
if apps link to ‘search’ with a canary uri, the controller now redirects the browser to the standard splunk uri, retaining other params.
Deleting the “Messaging” module as it dates from extremely early on in Canary’s timeline and the level of configurability that it aimed for now seems silly. All messaging rewritten to be handled by a single message area for now.
Fixed bugs in CheckboxPulldown and Multiplexer modules that were causing an extra cycle of job dispatch+cancel in some cases.
Fixed a bug in the AppNav module where clicks upon the actual arrow icons would fail to open the submenu.
Introduced a mechanism where any module can set a “hideChildrenOnload” param to True, and all downstream modules will load hidden when the page first loads.
Fixed a bug where modules in some hierarchies would end up with the incorrect layout panel
Fixed bugs in the Pager module around the two-pager configuration (with one above and one below).
Fixed a bug where job progress events were not firing on previewable jobs.
Chart module modified so on progress events it will update it’s existing chart object instead of recreating it from scratch.
Search module now can accept $foo$ tokens in its “preview” param, allowing this to be set from form elements or other upstream logic
Chart module now, even if the job is not previewable, it will at least update with a little “Loading (12.34%)” text.
TimePicker module now gets the times.conf stanzas in correct order (sorted by the order key, numerically)
Fixed a bug in CheckboxPulldown where in some cases it would erroneously deselect all of its options on page load (instead of selecting all).
Version 0.6 (August 23rd, 2019)
A list of release notes is not feasible since this is about 7 years of development. Such a list would include thousands of stories added and defects resolved.