topic Re: form : view results in Dashboards & Visualizations

form : view results

LauraBre — Sun, 24 Jun 2012 11:21:19 GMT

Hello,

I create a form with "single" but we can't see the results of the search button. How can do it to have a link "view result".

Thanks by advance for your answer.

This is a part of my xml file:

<form>

...

      <searchString>source=tcp:5555 PURCH_DAY=06-14 PURCH_DATE=19 PA_HOST="|tpwacs01v.priv.atos.fr" SD_STAT_PA="YES" | stats count | rangemap field=count severe=0-0 elevated=1-40 default=low</searchString>

      <title>Host: tpwacs01v.priv.atos.fr</title>

      <earliestTime>-7d</earliestTime>

      <option name="beforeLabel">PA YES : </option>

      <option name="classField">range</option>

      <option name="field">count</option>

    </single>

  </row>

...
</form>

Re: form : view results

Drainy — Sun, 24 Jun 2012 11:34:03 GMT

Right, so I know how to do this via advanced XML so that is what my answer will be in, its quite easy once you get into it and generally most users end up having to jump into it sooner or later 🙂
As per;
http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/ModuleReference

You want;

linkFields
Specify whether to just link the result, or include labels. To link the result and both labels, specify "result,beforeLabel,afterLabel"
defaults to: result

linkSearch
Specify a valid complete search query to turn the result into a clickable link

To convert your existing dashboard to advanced XML just append ?showsource=1 to the end of the URL. As an example I have created a singleValue for you below in advanced XML;

Or at least I would if Splunkbase would let me paste it properly! I've put it here; http://pastebin.com/Q3GFK60z

The way you mention in your question, with a click to view results, can cause formatting issues with singleValues but if you really want you can do it with a ViewRedirectorLink module as per the module reference above, just reply if you're after that.

Re: form : view results

LauraBre — Sun, 24 Jun 2012 21:15:50 GMT

Thx for your answer. I don't understand very well how have I to do to convert my dashboard because I don't have url in my xml file.

<?xml version='1.0' encoding='utf-8'?>

UVB : Error Codes

...

my search
Host: tpw.fr
-7d
VE YES:
range
count

Re: form : view results

Drainy — Sun, 24 Jun 2012 21:31:53 GMT

so lets say that your dashboard is called bobsthings. You would go to the URL http://SPLUNKSERVER:8000/en-GB/app/search/bobsthings?showsource=1 assuming you are using port 8000, not SSL and en-GB 🙂 (although that will work anyway, regardless)

Re: form : view results

LauraBre — Mon, 28 Sep 2020 11:58:54 GMT

Thx very much for your answer. I create a view following yours links. I have a problem when I go on the link. The error is:Splunk cannot find the "dashboard" view.This page was linked to from http://odpc:8000/en-US/app/ACS/ACS_alertes.
This is my xml file :

result
source=tcp:5555 PCH_D=06-14 PCH_DT=19|stats count
range

Re: form : view results

smolcj — Wed, 05 Dec 2012 04:41:34 GMT

How can we add a dropdown box variable to this link search?

Re: form : view results

smolcj — Wed, 05 Dec 2012 09:05:25 GMT

is it possible to pass the same through linkview? like along with the viewname foreg flashtimeline?source=$form.sources$
something like that
please help