How do I update Deprecated Tag?

[anilwale]

Hello,

I am using the below tag in my Dashboard and now it's deprecated in the new version, can someone tell me a replacement for the below syntax?

<populatingSearch fieldForValue="EventType" fieldForLabel="EventType" >
<![CDATA[$env$ source=$ProcessingNode$ $stepfilter$ $timerange$ | dedup EventType | $FilterEventType$| table EventType]]>
</populatingSearch>

[anilwale]

Thank you gcusello, it works.

Also Can you please let me know the correct tag for classField and linkView ? I saw both are deprecated. 

 <single>
<search>
<query>$env$ $inboundeventtypes$ $inboundpublishersources$ $inboundsourcelogfiles$ Step=BusinessEventAcknowledgement OR Step=EventAcknowledgement $timerange$ | dedup RootActivityId| stats count As Total</query>
</search>
<option name="classField">range</option>
<option name="field">Total</option>
<option name="linkView">search</option>
<option name="refresh.link.visible">true</option>
<option name="underLabel">Total Received</option>
<drilldown>
<set token="showPub">true</set>
<set token="IU">$msgType$</set>
<unset token="sname"></unset>
<unset token="bet"></unset>
<unset token="showSuccess"></unset>
<unset token="showError"></unset>
</drilldown>
<option name="drilldown">all</option>
</single> 

[gcusello]

Hi @anilwale,

linkView isn't required: if you enabled drilldown it automatically open the search dashboard.

I 'don't know classField, sorry.

You can see in the Dashboard Examples App all the information you need https://splunkbase.splunk.com/app/1603

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @anilwale ,

please try this:

    <input type="dropdown" token="EventType">
      <label>EventType</label>
      <fieldForLabel>EventType</fieldForLabel>
      <fieldForValue>EventType</fieldForValue>
      <search>
        <query>
          $env$ source=$ProcessingNode$ $stepfilter$ $timerange$ 
          | dedup EventType 
          | $FilterEventType$
          | table EventType
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <default>*</default>
    </input>

beware that I used the field name "Time" for the time picker.

Ciao.

Giuseppe