topic Re: one search multiple chart in Splunk Search https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19213#M2895 <P>That works very well, I just opened the xml file in vi and replaced it. It didn't like using the UI view for that. Thanks a lot!</P> Tue, 05 Feb 2013 22:09:57 GMT mmattek 2013-02-05T22:09:57Z one search multiple chart https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19206#M2888 <P>trying to consolidate (only erun search once. I see some example but without my dropdown feeding the seach. Can anyone help?</P> <PRE><CODE> &lt;?xml version='1.0' encoding='utf-8'?&gt; &lt;form&gt; &lt;label&gt;ManagedServiceRuns&lt;/label&gt; &lt;fieldset&gt; &lt;input type="dropdown" token="thisclient"&gt; &lt;label&gt;client&lt;/label&gt; &lt;populatingSavedSearch fieldForValue="client" fieldForLabel="client"&gt;clientlistForJobs&lt;/populatingSavedSearch&gt; &lt;/input&gt; &lt;!-- Add default TimePicker --&gt; &lt;input type="time" /&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;chart&gt; &lt;searchTemplate&gt;sourcetype=jobinfo client="$thisclient$" | fields JobDurationSecs, jobName | timechart max(JobDurationSecs)&lt;/searchTemplate&gt; &lt;title&gt;ManagedServiceMaxTime Chart&lt;/title&gt; &lt;option name="charting.chart"&gt;line&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;connect&lt;/option&gt; &lt;option name="charting.legend.showMarkers"&gt;true&lt;/option&gt; &lt;/chart&gt; &lt;/row&gt; &lt;row&gt; &lt;chart&gt; &lt;searchTemplate&gt;sourcetype=jobinfo client="$thisclient$" | fields positionsAttempted |timechart max(positionsAttempted)&lt;/searchTemplate&gt; &lt;title&gt;ManagedServiceRuns Positions Attempted Chart&lt;/title&gt; &lt;option name="charting.chart"&gt;line&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;connect&lt;/option&gt; &lt;option name="charting.legend.showMarkers"&gt;true&lt;/option&gt; &lt;/chart&gt; &lt;/row&gt;&lt;row&gt; &lt;chart&gt; &lt;searchTemplate&gt;sourcetype=jobinfo client="$thisclient$" | fields averageReportsSize |timechart max(averageReportsSize)&lt;/searchTemplate&gt; &lt;title&gt;ManagedServiceRuns Averrage ReportSizeChart&lt;/title&gt; &lt;option name="charting.chart"&gt;line&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;connect&lt;/option&gt; &lt;option name="charting.legend.showMarkers"&gt;true&lt;/option&gt; &lt;/chart&gt; &lt;/row&gt; &lt;/form&gt; </CODE></PRE> Mon, 04 Feb 2013 20:51:15 GMT https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19206#M2888 mmattek 2013-02-04T20:51:15Z Re: one search multiple chart https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19207#M2889 <P>I think you may have to leave the world of simple and form xml behind and move into full blown view (advanced) xml. </P> <P>This will do the trick in advanced xml (assuming I made no errors I do not have your searches and thus was unable to test):</P> <PRE> <VIEW autocancelinterval="90" isvisible="true" objectmode="SimpleForm" onunloadcanceljobs="true" template="dashboard.html"> <LABEL>ManagedServiceRuns</LABEL> <MODULE name="AccountBar" layoutpanel="appHeader"></MODULE> <MODULE name="AppBar" layoutpanel="navigationHeader"></MODULE> <MODULE name="Message" layoutpanel="messaging"> <OBJECT><PARAM name="maxSize" />1 <PARAM name="filter" />* <PARAM name="clearOnJobDispatch" />False </OBJECT></MODULE> <MODULE name="Message" layoutpanel="messaging"> <OBJECT><PARAM name="maxSize" />1 <PARAM name="filter" />splunk.search.job <PARAM name="clearOnJobDispatch" />True </OBJECT></MODULE> <MODULE name="TitleBar" layoutpanel="viewHeader"> <OBJECT><PARAM name="actionsMenuFilter" />dashboard </OBJECT></MODULE> <MODULE name="SearchSelectLister" layoutpanel="viewHeader"> <OBJECT><PARAM name="label" />client <PARAM name="searchFieldsToDisplay" /> <LIST> <PARAM name="value" />client <PARAM name="label" />client </LIST> <PARAM name="savedSearch" />clientlistForJobs <PARAM name="staticFieldsToDisplay" /> <PARAM name="searchWhenChanged" />False <PARAM name="settingToCreate" />thisclient_setting <MODULE name="ConvertToIntention"> <PARAM name="settingToConvert" />thisclient_setting <PARAM name="intention" /> <PARAM name="arg" /> <PARAM name="thisclient" /> <PARAM name="value" />$target$ <PARAM name="fillOnEmpty" />True <PARAM name="name" />stringreplace <MODULE name="TimeRangePicker"> <PARAM name="searchWhenChanged" />False <MODULE name="SubmitButton"> <PARAM name="label" />Search <PARAM name="allowSoftSubmit" />True <PARAM name="visible" />True <PARAM name="updatePermalink" />True <MODULE name="HiddenSearch" autorun="False"> <PARAM name="search" />sourcetype=jobinfo client="$thisclient$" | fields averageReportsSize |timechart max(averageReportsSize) <MODULE name="HiddenPostProcess" layoutpanel="panel_row1_col1" group="ManagedServiceMaxTime Chart"> <PARAM name="groupLabel" />ManagedServiceMaxTime Chart <PARAM name="search" /> <MODULE name="ViewstateAdapter"> <PARAM name="suppressionList" /> <ITEM>charting.chart.nullValueMode</ITEM> <ITEM>charting.chart</ITEM> <ITEM>charting.legend.showMarkers</ITEM> <MODULE name="HiddenFieldPicker"> <PARAM name="strictMode" />True <MODULE name="JobProgressIndicator"> <MODULE name="EnablePreview"> <PARAM name="display" />False <PARAM name="enable" />True <MODULE name="HiddenChartFormatter"> <PARAM name="charting.chart.nullValueMode" />connect <PARAM name="charting.chart" />line <PARAM name="charting.legend.showMarkers" />true <MODULE name="JSChart"> <PARAM name="width" />100% <MODULE name="Gimp"></MODULE> <MODULE name="ConvertToDrilldownSearch"> <MODULE name="ViewRedirector"> <PARAM name="viewTarget" />flashtimeline </MODULE> </MODULE> </MODULE> <MODULE name="ViewRedirectorLink"> <PARAM name="viewTarget" />flashtimeline </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> <MODULE name="HiddenPostProcess" layoutpanel="panel_row2_col1" group="ManagedServiceRuns Positions Attempted Chart"> <PARAM name="groupLabel" />ManagedServiceRuns Positions Attempted Chart <PARAM name="search" /> <MODULE name="ViewstateAdapter"> <PARAM name="suppressionList" /> <ITEM>charting.chart.nullValueMode</ITEM> <ITEM>charting.chart</ITEM> <ITEM>charting.legend.showMarkers</ITEM> <MODULE name="HiddenFieldPicker"> <PARAM name="strictMode" />True <MODULE name="JobProgressIndicator"> <MODULE name="EnablePreview"> <PARAM name="display" />False <PARAM name="enable" />True <MODULE name="HiddenChartFormatter"> <PARAM name="charting.chart.nullValueMode" />connect <PARAM name="charting.chart" />line <PARAM name="charting.legend.showMarkers" />true <MODULE name="JSChart"> <PARAM name="width" />100% <MODULE name="Gimp"></MODULE> <MODULE name="ConvertToDrilldownSearch"> <MODULE name="ViewRedirector"> <PARAM name="viewTarget" />flashtimeline </MODULE> </MODULE> </MODULE> <MODULE name="ViewRedirectorLink"> <PARAM name="viewTarget" />flashtimeline </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> <MODULE name="HiddenPostProcess" layoutpanel="panel_row3_col1" group="ManagedServiceRuns Averrage ReportSizeChart"> <PARAM name="groupLabel" />ManagedServiceRuns Averrage ReportSizeChart <PARAM name="search" /> <MODULE name="ViewstateAdapter"> <PARAM name="suppressionList" /> <ITEM>charting.chart.nullValueMode</ITEM> <ITEM>charting.chart</ITEM> <ITEM>charting.legend.showMarkers</ITEM> <MODULE name="HiddenFieldPicker"> <PARAM name="strictMode" />True <MODULE name="JobProgressIndicator"> <MODULE name="EnablePreview"> <PARAM name="display" />False <PARAM name="enable" />True <MODULE name="HiddenChartFormatter"> <PARAM name="charting.chart.nullValueMode" />connect <PARAM name="charting.chart" />line <PARAM name="charting.legend.showMarkers" />true <MODULE name="JSChart"> <PARAM name="width" />100% <MODULE name="Gimp"></MODULE> <MODULE name="ConvertToDrilldownSearch"> <MODULE name="ViewRedirector"> <PARAM name="viewTarget" />flashtimeline </MODULE> </MODULE> </MODULE> <MODULE name="ViewRedirectorLink"> <PARAM name="viewTarget" />flashtimeline </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> </MODULE> </OBJECT></MODULE> </VIEW> </PRE> Tue, 05 Feb 2013 01:06:26 GMT https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19207#M2889 tfletcher_splun 2013-02-05T01:06:26Z Re: one search multiple chart https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19208#M2890 <P>this should also be tagged with xml formxml advancedxml</P> Tue, 05 Feb 2013 01:09:20 GMT https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19208#M2890 tfletcher_splun 2013-02-05T01:09:20Z Re: one search multiple chart https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19209#M2891 <P>well, when I put that in the editor, now I can't find the view? Should I not have edited the exiting view? I guess I will try making a new one? btw, this is 4.3.5 if that matters</P> Tue, 05 Feb 2013 21:06:44 GMT https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19209#M2891 mmattek 2013-02-05T21:06:44Z Re: one search multiple chart https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19210#M2892 <P>This is an advanced xml view. You probably need to follow the directions for creating an advanced xml view as the graphical editor for your form view most likely expected form xml.</P> Tue, 05 Feb 2013 21:27:13 GMT https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19210#M2892 tfletcher_splun 2013-02-05T21:27:13Z Re: one search multiple chart https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19211#M2893 <P>yeah the issue is missing layout panels that's why nothing renders. just a moment...</P> Tue, 05 Feb 2013 21:31:29 GMT https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19211#M2893 tfletcher_splun 2013-02-05T21:31:29Z Re: one search multiple chart https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19212#M2894 <P>The edited version I have tested on 5.0.1. Should work in 4.3.5.</P> Tue, 05 Feb 2013 21:48:19 GMT https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19212#M2894 tfletcher_splun 2013-02-05T21:48:19Z Re: one search multiple chart https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19213#M2895 <P>That works very well, I just opened the xml file in vi and replaced it. It didn't like using the UI view for that. Thanks a lot!</P> Tue, 05 Feb 2013 22:09:57 GMT https://community.splunk.com/t5/Splunk-Search/one-search-multiple-chart/m-p/19213#M2895 mmattek 2013-02-05T22:09:57Z