topic Re: Simple XML dashboards: open in pivot / open is search in Dashboards & Visualizations

Simple XML dashboards: open in pivot / open is search

MatMeredith — Thu, 04 Sep 2014 15:10:53 GMT

I'm building some simple XML dashboards with inline searches based on the pivot command.

The dashboard automatically adds an "open in pivot" or an "open in search" option to each table / chart. Sometimes though it adds "open in pivot" to charts / tables that have searches that pipe the results of the pivot command to subsequent stats / eval commands. When you click on open in pivot for such a chart you (unsurprisingly) get an error message.

Is there someway that I can force Splunk to add "open is search" rather than "open in pivot"? (I'm not sure how it's choosing currently). Or failing that to hide these options completely?

Thanks!

Re: Simple XML dashboards: open in pivot / open is search

MatMeredith — Thu, 04 Sep 2014 15:25:11 GMT

OK -- so it looks like this should work...

true
false

If I specify these on e.g. a table where Splunk is currently showing "open in pivot" but it doesn't work, then the "open in pivot" option is hidden, but it still doesn't offer the "open in search" that would work...

Re: Simple XML dashboards: open in pivot / open is search

mikaelbje — Fri, 16 Jan 2015 09:01:58 GMT

Just found this question. It looks like your example got left out, but I believe you were referring to:

<option name="link.openPivot.visible">false</option>

Which works fine to disable open in Pivot but it would be great if we could get it replaced with open in Search

Re: Simple XML dashboards: open in pivot / open is search

helge — Mon, 27 Feb 2017 17:05:56 GMT

I encountered the problem that Splunk was switching from "open in search" to "open in pivot" when modifying an existing dashboard. In my case when the number of filter statements per search went above four, Splunk would switch from "open in search" to "open in pivot".

That behavior is a bit unfortunate since "open in pivot" does not work but shows the error "Your pivot cannot complete because the search string could not be parsed into a valid pivot configuration."

I would like to be able to force Splunk to always show "open in search".

This was tested on Splunk Enterprise 6.5.2.