topic Re: Calling multiple Search Templates in a form in Dashboards & Visualizations

Calling multiple Search Templates in a form

alenseb — Wed, 28 Nov 2012 04:55:06 GMT

Hi All,

I am trying to call to 2 search template in the same form and then display them with different charts.
However, I found the charts in lower part can't show anything unless if remove the first search Template the corresponding charts.
Is this possible to do?

Please suggest.

Thanks!!

This is the code:

<form>
  <label>Simple select drop down</label>
  <!-- define master search template, with replacement tokens delimited with $ -->
  <searchName>abc</searchName>
  <searchTemplate>sourcetype="search1"</searchTemplate>
  <earliestTime>-300d</earliestTime>
  <latestTime>-0d</latestTime>
  <searchTemplate>"search2"</searchTemplate>
  <earliestTime>-300d</earliestTime>
  <latestTime>-0d</latestTime>
  <fieldset>
    <!-- Define a simple dropdown form driven by a search -->
    <input type="dropdown" token="UserName">
      <label>Select user</label>
      <populatingSearch fieldForValue="UserName" fieldForLabel="UserName"><![CDATA[|savedsearch Details|top UserName]]></populatingSearch>
      <choice value="%">All</choice>
    </input>
  </fieldset>
  <row>
    <chart>
      <title>TimeChart</title>
      <option name="charting.chart">pie</option>
    </chart>
    <chart>
      <title>TimeChart</title>
      <option name="charting.chart">bar</option>
    </chart>
  </row>
</form>

Re: Calling multiple Search Templates in a form

jonuwz — Wed, 28 Nov 2012 11:32:51 GMT

Move the searches inside the charts.

i.e.

<chart>
  <searchTemplate>sourcetype="search1"</searchTemplate>
  <earliestTime>-300d</earliestTime>
  <latestTime>-0d</latestTime>
  <title>TimeChart</title>
  <option name="charting.chart">pie</option>
</chart>

If you have 2 search templates at the same level, one will clobber the other.

If you view the advanced xml (add ?showsource=t to the end of your views URL) you'll see what the simple XML gets converted to.

Whole sections of your forms xml mysteriously disappear.

Here's a working example :

<form>
  <label>Dashboard to convert to Form Search</label>
  <fieldset>
    <input type="text" token="series">
      <label>sourcetype</label>
      <default/>
      <seed>splunkd</seed>
      <suffix>*</suffix>
    </input>
  </fieldset>
  <row>
    <chart>
      <searchTemplate>index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | timechart avg(eps) </searchTemplate>
      <earliestTime>-1w</earliestTime>
      <latestTime>-1d</latestTime>
      <option name="charting.chart">line</option>
    </chart>
    <chart>
      <searchTemplate>index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | timechart avg(kbps) </searchTemplate>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.chart">column</option>
    </chart>
  </row>
</form>

Re: Calling multiple Search Templates in a form

alenseb — Thu, 29 Nov 2012 05:57:35 GMT

Thanks!
That worked! 🙂

Re: Calling multiple Search Templates in a form

0range — Thu, 20 Mar 2014 09:29:16 GMT

Is it the same to separate searches in every chart?

Re: Calling multiple Search Templates in a form

0range — Thu, 27 Mar 2014 09:18:16 GMT

How do the separate searchtemplate work in this example? Is there any performance profit? I do not understand

Re: Calling multiple Search Templates in a form

hartfoml — Tue, 27 Oct 2015 12:44:35 GMT

thanks @jonuwz this helps with my problem as well.

What if you want to use one search for several rows and another search for a few more rows.

Using your example at what level above the row would you put the template and still allow to run separately and only once each time the dashboard is refreshed?