Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
All Apps and Add-ons
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- How can I place a search bar above a sankey chart?
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hylam
Contributor
11-26-2015
11:02 PM
It should work like a search app with sankey chart visualization. The running search should cause the sankey chart and stats table to update. Don't forget the time picker.
EDIT1
wide text box + submit button + separate time picker should work, too.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MuS
Legend
11-29-2015
06:58 PM
Hi hylam,
take this run everywhere dashboard to see how it can be done:
<form script="autodiscover.js">
<label>my_foo_selector Clone</label>
<fieldset submitButton="ture">
<input type="time" token="time">
<label>Select time range:</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="text">
<label>Enter text to search:</label>
<default>*</default>
</input>
</fieldset>
<search id="viz_search">
<query>
<![CDATA[
index=_internal $text$ earliest="$time.earliest$" latest="$time.latest$" sourcetype=splunk_web_access NOT uri_path=*/static/* uri_path=*/app/* OR uri_path=*/manager/*
| rex field=referer "https?://.+?/.+?(?<referer_path>/[^\\?]+)"
| rex field=uri_path "/.+?(?<path>/.+)"
| rename referer_path as from path as to
| stats count by from to | sort -count | head 50
]]>
</query>
</search>
<row>
<panel>
<html>
<h2>Sankey</h2>
<div id="sankey" class="splunk-view" data-require="app/simple_xml_examples/components/sankey/sankey" data-options="{ "managerid": "viz_search", "height": 400 }">
</div>
</html>
</panel>
</row>
</form>
You must have the Simple XML dashboard example App installed https://splunkbase.splunk.com/app/1603/
Hope this helps to get you started and change / modify / add any additional charts as needed 😉
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MuS
Legend
11-29-2015
06:58 PM
Hi hylam,
take this run everywhere dashboard to see how it can be done:
<form script="autodiscover.js">
<label>my_foo_selector Clone</label>
<fieldset submitButton="ture">
<input type="time" token="time">
<label>Select time range:</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="text">
<label>Enter text to search:</label>
<default>*</default>
</input>
</fieldset>
<search id="viz_search">
<query>
<![CDATA[
index=_internal $text$ earliest="$time.earliest$" latest="$time.latest$" sourcetype=splunk_web_access NOT uri_path=*/static/* uri_path=*/app/* OR uri_path=*/manager/*
| rex field=referer "https?://.+?/.+?(?<referer_path>/[^\\?]+)"
| rex field=uri_path "/.+?(?<path>/.+)"
| rename referer_path as from path as to
| stats count by from to | sort -count | head 50
]]>
</query>
</search>
<row>
<panel>
<html>
<h2>Sankey</h2>
<div id="sankey" class="splunk-view" data-require="app/simple_xml_examples/components/sankey/sankey" data-options="{ "managerid": "viz_search", "height": 400 }">
</div>
</html>
</panel>
</row>
</form>
You must have the Simple XML dashboard example App installed https://splunkbase.splunk.com/app/1603/
Hope this helps to get you started and change / modify / add any additional charts as needed 😉
cheers, MuS
Get Updates on the Splunk Community!
.conf25 Registration is OPEN!
Ready. Set. Splunk!
Your favorite Splunk user event is back and better than ever. Get ready for more technical ...
Detecting Cross-Channel Fraud with Splunk
This article is the final installment in our three-part series exploring fraud detection techniques using ...
Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside
Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...
