Canary
Overview
Details
Since it is backwards compatible to a subset of the "Sideview XML" views that you might have created with Sideview Utils, it offers a path for existing Sideview Utils content to potentially continue running even in Splunk 8, 9 and beyond.
It is a descendant of Sideview Utils but whereas Sideview Utils ran on top of Splunk’s “Advanced XML” systems, Canary does not.
For a great deal more information about Canary, see our website ( https://sideviewapps.com/documentation/canary )
NOTE: This app runs in python3 without any problems and without any changes required. Splunk's "Upgrade Readiness App" may erroneously state that our apps do not run in python3 but it is wrong and we have been working with Splunk to try and get them to address this.
You can download Canary under the terms of the Sideview Free Internal Use License Agreement and test it out on either Splunk 7.X, 8.X or 9.X
What you need to know about Canary depends a little on what kind of user you are.
Release Notes
Version 1.7.4
- Disabled certificate verification when Canary talks to splunkd itself, as appinspect no longer requires it.
Version 1.7.3
-- Fixed a bug around timezone handling, where users with default TZ setting of "Default System Timezone" who then also had their local (browser) tz differing from the server's tz, could get inconsistent UI behavior when searching for custom absolute time ranges.
-- Improved user messaging in the ProgressIndicator module, particularly around search cancellation, and specific API situations where progress can be at "0%" for a long time.
-- Fixed a bug in the Chart module where it did not do the right thing when "hideChildrenOnload" was set to False.
-- The Apps menu in the TopNav module is now sorted alphabetically by label, instead of by the app_id.
-- Fixed a bug in the Pulldown module where the staticOptions param would not dynamically substitute the value of $foo$ tokens at runtime.
Version 1.7.2
-- Fixed a bug in the Pager module that was introduced in 1.7.1, where in many cases pagination links would not render.
Version 1.7
Canary now supports dark mode, and the user can change to dark mode in a new "preferences" layer in the top nav bar.
Likewise other apps built in the Canary UI can now add dark mode to their supported themes in app.conf
Version 1.6.2
-- Improvements in some complex cases around back button usage, where subsequent custom interactions could be effectively ignored by upstream modules.
-- Fields module will no longer refresh if it sees known bad characters in the prefix the user has typed.
-- Fixed a bug where if a Tabs module was configured with purely dynamic tabs (rendered from search results), and no explicit selection, it would not default to showing the first tab selected.
Version 1.6.1
-- Fixed a bug in the Table module, where in some situations it failed to pass down drilldown tokens holding the values of its "hidden" fields.
-- Chart command, when using a "split by" field, will look for a particular token named <fieldname>.fieldOrder, and will reorder the data so that the legend items are rendered in that order.
Version 1.6
Unfortunately Splunkbase truncates release notes so we are unable to include them here.
However you can always read our release notes on the Sideview website at
https://sideviewapps.com/documentation/canary-release-notes
Version 1.5.14
- Fixed a bug where if a report was saved in a view with a textfield, and the value saved into the textfield contained an html unsafe char like < or >, it would come out escaped when the report was run.
Note: to read our full release notes you can always do so on our website https://sideviewapps.com/documentation/canary-release-notes
Version 1.5.13
- Fixed a bug where some form field modules wouldn't work correctly if the selected value was "0"
- Fixed a bug in the app navigation bars of all Canary apps where custom anchor links did not always work when in Simple XML's edit mode.
- Fixed a bug in advanced Table drilldown use cases when using the Report module and an "over none" option for the x-axis.
Version 1.5.12
If Splunk returns an error that the search could not be dispatched because the user's srchDiskQuota has been exceeded, Canary now treats this as an error and displays it to the user. (Splunk search treats this as INFO which makes it hard for the user to even find).
- Fixed a bug where the Canary UI would display the product as "Splunk> enterprise" even when running in Splunk Cloud.
- Fixed a bug where CheckboxPulldown's "sticky" param would not be respected for dynamic option values and the previously saved selection state would be ignored.
Version 1.5.11
Splunkbase limits release notes to only 1000 characters.
However you can always see our full release notes on our site - https://sideviewapps.com/documentation/canary-release-notes
Version 1.5.8
- Added a new UI tool called "The Canarifier" that automates various busywork that app-owners need to do, if they ever want to make a particular app of theirs seamlessly switch between Canary views and non-canary views.
- Fixed a bug in the ProgressIndicator module where while the job was still dispatching or was queued, some messaging was not displaying to reflect that status to the user. Instead the module was remaining blank until later when Canary had the first explicit job information return from our poller.
Version 1.5.7
Unfortunately Splunkbase allows only a strangely low number of characters for release notes, and the release notes for this release exceed them.
Fortunately you can always read the release notes for Canary on our website here - https://sideviewapps.com/apps/canary/release-notes/
Version 1.5.6
- TopNav module no longer offers a "logout" option when the Splunk Free license is being used.
- Fixed a bug in the Sideview Editor where in "Runtime Debug" mode the display would not update when the developer interacted with the modules in the preview pane.
- Table module now has a param "height" that can be set to a number of pixels (eg "400px"), in which case it will have a maximum height of 400px.
- Fixed a bug that would arise if you used Multiplexed Multiplexers to dispatch searches. If you don't know what that means then you aren't having enough fun with Canary yet.
Version 1.5.5
- When a search has errors but they're of a kind that splunk only includes on the jobs endpoint response - these are now picked up and displayed in the UI. Previously the Canary UI did pick up most errors, but only when they were returned either on the dispatch POST or on any of the results endpoints.
- Canary now implements the convention used by other Sideview apps, where app navigation URI's are to a special redirection endpoint. This fixes a class of bugs where navigating to a core Splunk view (like "search") and then to back to a Canary view lands you on a broken page.
- Report module now will detect if the xField is "hour_of_day" or "date_hour" and it will make sure all of the hours in [00,23] are represented in the table/chart.
Version 1.5.4
- Fixed a minor bug that caused pagetitles to render improperly sometimes when there were more than 30 apps installed.
- Fixed a bug that affected some complex views that used PostProcess requests to render both their UI elements and their main results from the same underlying job.
Version 1.5.3
Fixed a recent regression that prevented Canary views from rendering on Splunk 7.3
Version 1.5.2
- Fixed a CSS problem that caused Table modules with complex multivalue cell drilldown to wiggle a little bit as different elements were moused over.
- Changes in the AppNav module to allow other code to trigger a reload of the savedsearches or saved dashboards list when appropriate..
- Fixed a rare bug that seemed to affect a small number of Splunk Cloud deployments, that caused some redirects to the core "search" or "report" views to hang.
Version 1.5.1
- Fixed a problem introduced in 1.5 where in many cases users would end up on the wrong URL's and get 404 errors. The root cause was that the AppNav module was not correctly following Canary's conventions around "shunt" endpoints.
Version 1.5
Unfortunately Splunkbase truncates release notes to 1000 characters and this is not sufficient to adequately summarize the changes in this release. Fortunately you can read our release notes on our site at the following URL
https://sideviewapps.com/apps/canary/release-notes/
Version 1.4.11
- Improvements to the Report module. It will now generate a report when the xField is null, ie when there is no 'group by' field. It will also do so when there is no xField but there is a split-by field.
- Fixed a bug in the Chart module, where in some cases it would begin the y-axis at a non-zero number.
- Fixed a rare bug in Pulldown - if you had a null option in staticFields and then another non-null option that wasn't the first option and you wanted that non-null option to be selected, the module would previously refuse to do so.
- Fixed a bug where subsearch truncation warnings were not displayed in the Canary UI.
Version 1.4.10
- Fixed an obscure bug in CheckboxPulldown. When it was processing clicks coming from downstream from interactive modules like Tables, it would update visually to remove the old selection but it would keep outputting the searchterm for it.
- Fixed a minor bug that when ProgressIndicator modules were Multiplexed they would render an extra copy of their internal HTML
- Improvement to the Fields module - when the layer is opened the textbox to filter available fields is now selected by default so the user can just go straight to searching for fields they want to add.
- Improvements to the Events module. Fixing the softWrap support, timestamp rendering, field/value clicking.
Version 1.4.9
- Improved the Chart module's tooltips in timechart cases - it now lists a readable description of the start and endtime. Formerly it only displayed the string formatted start time
- Improved the display of timeranges such that single units eg single days or months display more compactly as "August 23rd 2021", or "August 2021".
- Moved over the "violation predictor" alert from the old Sideview Admin Tools app, as this should have been added to Canary when the "License Monitor" dashboard was added. They were designed to work together.
- Fixed a bug in the TimePicker where if you used the "All Time" timerange, previously the preference that would get saved would leave the latest=now key from your prior timerange preference, thus inadvertently filtering out any events that happened to be timestamped slightly in the future.
- Sideview Editor now correctly returns an error if a user in Add or Reattach mode tries to make any module a child of a module that has set "forbidsDownstreamModules"
Version 1.4.8
- Fixed a bug in the CheckboxPulldown module where if selectAllOptimization is set to "*", the module would sometimes select all options unexpectedly when an upstream change was made.
- Fixed a bug in the TimePicker module where if URLLoader had keepURLUpdated set to True then changes upstream from a TimePicker module would reset the TimePicker from the "soft querystring" value aka the hash querystring value back to what it had been on the initial pageload.
Version 1.4.7
Fixed a bug that prevented Canary views from working when the logged-in user had a space in their username
Version 1.4.6
- Brought over the "License Monitor" view that was previously in Sideview Admin Tools and made sure it works with Canary
- Fixed a bug in the Table module where it was impossible to sort the results by time, ie by the "time" field.
- Fixed a bug in the TimePicker module's Custom Date/Time mode, where if you set only the earliest or latest side, it would display an error and fail to run.
- Search module's "clearPostProcess" param now works properly
- Fixed a bug in the Table module where it would only write the "click.selectedTableName" key to the context if drilldown was in "cell" mode.
- HTML and Radio modules now have float and clear params.
- Improved behavior of the Pulldown module's progress bar, when several Pulldowns are rendering data from the same job.
- Fixed a bug where the UI could freeze when certain permalinks were loaded, in complex views with "Switcher" and "Tabs" modules.
- Improved behavior in some unusual cases where modules or customBehavior code was dealing with the specific field "name".
Version 1.4.5
- Fixed a regression introduced in version 1.4 in the Report module. The bug was that if your view was using the binning options then the module would fail to mvexpand multivalue rows before the bin. This could result in a confusing mix of some binned values and some unbinned values in the final reports.
Version 1.4.4
- Fixed a bug in how Redirector handled generic drilldown where it would fail to overwrite values set by upstream form elements when appropriate with the value from the clicked upon chart element.
- Resolved a minor bug where Link modules that only had one child that was a Redirector module would not listen to the popup="true" param on the Redirector when clicked.
- Resolved a minor bug where the Table module's new drilldown="cell" mode didn't properly escape the main $row.cell.value$ key for use within the search language.
- Resolved a minor bug where if your app didn't specify a "label" in the [ui] stanza in app.conf, the app would be listed as "None" in the app menu, and "None" would appear on the right hand side of the AppNav module.
Version 1.4.3
- Fixed a bug introduced in Canary 1.4 affecting the table module. In advanced "table embedding" configurations the Table could end up displaying the wrong field values in the table columns.
- Resolved a bug where contextual action menus would show up underneath charts if "line", or "bar" charts were selected. Menus now appear on the marker or bar that the user clicks.
Version 1.4.2
- Canary modules including the Chart and TimePicker modules now always display and interpret times consistently in the user's preferred timezone preference (or splunk system TZ if no preference exists), rather than their browser's local timezone.
- Canary now has a "FreshMaker" view just like Sideview Utils. Developers can use this view to reload certain Splunk configurations from disk without a restart.
- Fixed a bug where the TimePicker module would often later start displaying "custom relative range" when you had selected some of the preset ranges in its menus
- Fixed a bug in the TimePicker module's calendar picker where the 'next month' and 'previous month' images were not visible
- If a developer picks a layoutPanel that exceeds the maximum number of rows or columns allowed, there is now an informative error message displayed on the page. Also those limits are raised from 10 columns to 20, and from 50 rows to 100.
Version 1.4.1
-- Fixed an issue where saved preferences from canary modules can later trigger warnings from btool's config validation when Splunk is restarted. There was no actual harm in the config as it existed in 1.4 so this fix effectively just makes the btool warnings go away. If you don't mind a few warnings on startup there's no need to update from 1.4.
Version 1.4
Unfortunately Splunkbase truncated release notes at only 1000 characters which is quite a bit less than the notes for this release. View our release notes online at https://sideviewapps.com/apps/canary/release-notes/
Version 1.3.11
Unfortunately Splunkbase truncates submitted release notes at a rather short length, and we're unable to include the actual release notes here.
However you can check out release notes on our website - https://sideviewapps.com/apps/canary/release-notes/
Version 1.3.9
- More fixes for deployments using root_endpoint config. saved search links in the app navigation bar are now fixed, and if you put the "search" view in your app nav explicitly the link will redirect appropriately now.
Version 1.3.8
Fixed a bug where some modules were making requests without considering whether "ROOT_ENDPOINT" was set in web.conf. This would result in pages not loading and working properly when Splunk was set up in a reverse proxy configuration.
Version 1.3.7
- Fixed a bug where users of Edge or Chrome, when exporting search results with the SearchControls module, wouldn't get the "csv" extension added to the filename in the save-as dialog
- Fixed a mistake in module_gallery.csv that was generating a very verbose WARN in the _internal index on some deployments, about the lookup having an illegal field name of "".
Version 1.3.6
-- Fixed a somewhat hard to hit bug involving 401 redirect and/or a redirect loop. Fix is to slightly alter the REST call that Canary uses to get the current httpport and root_endpoint config. Root cause appears to be incorrect behavior in Splunk's rest api in /services/configs/conf-web/settings, and confusing behavior in /servicesNS/nobody/-/configs/conf-web/settings. The app now gets the config from /services/properties/web/settings/*.
-- Fixed a bug that could prevent Canary from loading previously saved reports when users clicked on them in "saved reports" menus.
-- Fields module now has a "clear all" link above the selected field list and an "add all" link above the available field list.
Version 1.3.5
-- More work improving the overall system of how a "canary app" is supposed to be implemented so that no matter whether a user is in Splunk7 or Splunk8, or whether they're in a Canary view or a default splunk view, or a Sideview Utils view, that they can click on links in the app's navbar and end up in the right places, and they can click on the links in the app menu and end up on the right URI for that app's landing page.
-- Canary homepage now explicitly uses splunk_server=local on it's usage of the splunk rest command. Previously it seems we had relied on our users not having the "dispatch_rest_to_indexers" capability, because in that case Splunk falls back to only dispatching against the local SH.
-- Improvements to what you can have in legacy Sideview views, but still have Canary autoconvert the view and render it without complaint. For more complete details visit our release notes page at https://sideviewapps.com/apps/canary/release-notes/
Version 1.3.4
- Fixing a regression introduced in 1.3.3's Canary nav/homepage redirection improvements, where if the user went to Canary itself unfortunately the homepage would say "Loading Canary" but nothing would ever change.
- The "view the XML source for this view" links, on most docs/examples leaf pages, now work properly. Previously they were still trying to leverage an old controller in Sideview Utils which would then only work on older versions of Splunk. Now they just hit the view endpoint in Canary to do the same job.
- Improving the TopNav module's App switcher pulldown, so that if the given app is a Canary app using the new "home_redirect" convention, it just skips the redirect (since the Canary UI implicitly knows Canary is installed) and goes right to "home"
Version 1.3.3
Unfortunately Splunkbase is still truncating release notes to 1000 characters and that is not enough room for us to adequately display the notes for this release. Fortunately you can read the full release notes on our website at https://sideviewapps.com/apps/canary/release-notes/
Version 1.3.2
- Fixed a bug that affected some earlier Splunk 7.X versions, where any pages using the Tabs module would error out with "ImportError no module named six".
- Improved the homepage reports to properly differentiate internal splunk backbone views from "HTML dashboard" views. Also improved exception handling if XML views are encountered that have explicit encoding declarations.
Version 1.3.1
Unfortunately Splunkbase truncated release notes to only 1000 characters, and this is not sufficient to hold the release notes for this release. Fortunately you can read the release notes for 1.3 on our website here - https://sideviewapps.com/apps/canary/release-notes/
Version 1.3
Unfortunately Splunkbase truncated release notes to only 1000 characters, and this is not sufficient to hold the release notes for this release. Fortunately you can read the release notes for 1.3 on our website here - https://sideviewapps.com/apps/canary/release-notes/
Version 1.2.6
- Chart module now supports the old Splunk charting keys "charting.axisY.minimumNumber" and "charting.axisY.minimumNumber". When set, the given value will be used as a minimum or maximum value of the y-axis range. Notably though if the actual data being charted exceeds the maximum or is less than the minimum, then as implemented here the setting is ignored.
- Chart module now supports the old Splunk charting key of "charting.axisLabelsX.axisVisibility", which can be set to "hide" to hide the x-axis labels and tick marks entirely.
- Fixed a minor bug in the Chart module, where it's little text indication of job progress was hidden.
Version 1.2.5
Unfortunately Splunkbase truncates release notes to 1000 characters, and that exceeds the length of the notes for this release.
For our full release notes for this and all releases, see this page on our website.
Version 1.2.4
Unfortunately Splunkbase truncates release notes to 1000 characters, and that exceeds the length of the notes for this release.
For our full release notes for this and all releases, see this page on our website.
Version 1.2.3
- Fixed a bug in the CheckboxPulldown, Checkboxes and Radio modules where if only the postprocess search from upstream changed, these modules would not realize that they needed to reload their options.
- Improved the behavior of the Chart module when it is set to use a logarithmic Y axis. It now automatically gives the y-axis some breathing room, by specifying a max y-axis value that is twice as high as the highest point (remember - logarithmic scale, so 2x is only "a bit more").
Version 1.2.2
Updated the version of the multiselect library used under the hood for the CheckboxPulldown module. The specific bug this resolved was that the module could not support values that contain double-quote characters.
The Chart module now supports a "charting.seriesColors" key that can be passed to it, that is a comma-separated list of hexcolors. It will use the given colors to denote the colors of the various series being charted.
Some defaults changed in the Chart module for when only 2, 3, 4 or 5 series values are present. Previously the module had a tendency to put yellows and oranges next to eachother.
Version 1.2.1
Fixed a bug in the Chart module where if you changed the chart type and then moused over elements in the new chart in the right way, you could get the old chart to reappear, and the two charts to even flicker back and forth.
on receiving a 401 response from Splunk, Canary views now redirect to the Splunk login page.
Turning the Chart modules bezier curve feature way down so the lines are almost straight by default. Although the default beziers are pretty they can mislead/confuse users in some charts where the curvature displayed was then impossible in the real data.
Version 1.1.4
- CheckboxPulldown and Checkboxes modules now have a selectedCount $foo$ token that they output that represents the number of items currently selected. This is useful for contextual messages downstream.
- Chart module now supports the "legend.position" charting key. Values can be left, right, top,bottom. The default is "right".
- Fix for a regression in the Table module from a bugfix in 1.1.2 - that fix did indeed keep the "time" field from vanishing in some cases, but at the price of moving it's order in the columns to the end in some other cases. Fixed and these cases are now covered by additional unit testing.