Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
All Apps and Add-ons
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Re: How can I place a search bar above a sankey ch...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hylam
Contributor
11-26-2015
11:02 PM
It should work like a search app with sankey chart visualization. The running search should cause the sankey chart and stats table to update. Don't forget the time picker.
EDIT1
wide text box + submit button + separate time picker should work, too.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MuS
Legend
11-29-2015
06:58 PM
Hi hylam,
take this run everywhere dashboard to see how it can be done:
<form script="autodiscover.js">
<label>my_foo_selector Clone</label>
<fieldset submitButton="ture">
<input type="time" token="time">
<label>Select time range:</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="text">
<label>Enter text to search:</label>
<default>*</default>
</input>
</fieldset>
<search id="viz_search">
<query>
<![CDATA[
index=_internal $text$ earliest="$time.earliest$" latest="$time.latest$" sourcetype=splunk_web_access NOT uri_path=*/static/* uri_path=*/app/* OR uri_path=*/manager/*
| rex field=referer "https?://.+?/.+?(?<referer_path>/[^\\?]+)"
| rex field=uri_path "/.+?(?<path>/.+)"
| rename referer_path as from path as to
| stats count by from to | sort -count | head 50
]]>
</query>
</search>
<row>
<panel>
<html>
<h2>Sankey</h2>
<div id="sankey" class="splunk-view" data-require="app/simple_xml_examples/components/sankey/sankey" data-options="{ "managerid": "viz_search", "height": 400 }">
</div>
</html>
</panel>
</row>
</form>
You must have the Simple XML dashboard example App installed https://splunkbase.splunk.com/app/1603/
Hope this helps to get you started and change / modify / add any additional charts as needed 😉
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MuS
Legend
11-29-2015
06:58 PM
Hi hylam,
take this run everywhere dashboard to see how it can be done:
<form script="autodiscover.js">
<label>my_foo_selector Clone</label>
<fieldset submitButton="ture">
<input type="time" token="time">
<label>Select time range:</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="text">
<label>Enter text to search:</label>
<default>*</default>
</input>
</fieldset>
<search id="viz_search">
<query>
<![CDATA[
index=_internal $text$ earliest="$time.earliest$" latest="$time.latest$" sourcetype=splunk_web_access NOT uri_path=*/static/* uri_path=*/app/* OR uri_path=*/manager/*
| rex field=referer "https?://.+?/.+?(?<referer_path>/[^\\?]+)"
| rex field=uri_path "/.+?(?<path>/.+)"
| rename referer_path as from path as to
| stats count by from to | sort -count | head 50
]]>
</query>
</search>
<row>
<panel>
<html>
<h2>Sankey</h2>
<div id="sankey" class="splunk-view" data-require="app/simple_xml_examples/components/sankey/sankey" data-options="{ "managerid": "viz_search", "height": 400 }">
</div>
</html>
</panel>
</row>
</form>
You must have the Simple XML dashboard example App installed https://splunkbase.splunk.com/app/1603/
Hope this helps to get you started and change / modify / add any additional charts as needed 😉
cheers, MuS
Get Updates on the Splunk Community!
Congratulations to the 2025-2026 SplunkTrust!
Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!
The ...
Community Feedback
We Want to Hear from You! Share Your Feedback on the Splunk Community
The Splunk Community is built for you ...
Manual Instrumentation with Splunk Observability Cloud: Implementing the ...
In our observability journey so far, we've built comprehensive instrumentation for our Worms in Space ...
