All Apps and Add-ons

How do I update Deprecated Tag?

anilwale
New Member

Hello,

I am using the below tag in my Dashboard and now it's deprecated in the new version, can someone tell me a replacement for the below syntax?

 

<populatingSearch fieldForValue="EventType" fieldForLabel="EventType" >
<![CDATA[$env$ source=$ProcessingNode$ $stepfilter$ $timerange$ | dedup EventType | $FilterEventType$| table EventType]]>
</populatingSearch>

Labels (1)
Tags (1)
0 Karma

anilwale
New Member

Thank you gcusello, it works.

Also Can you please let me know the correct tag for classField and linkView ? I saw both are deprecated. 

 

 <single>
<search>
<query>$env$ $inboundeventtypes$ $inboundpublishersources$ $inboundsourcelogfiles$ Step=BusinessEventAcknowledgement OR Step=EventAcknowledgement $timerange$ | dedup RootActivityId| stats count As Total</query>
</search>
<option name="classField">range</option>
<option name="field">Total</option>
<option name="linkView">search</option>
<option name="refresh.link.visible">true</option>
<option name="underLabel">Total Received</option>
<drilldown>
<set token="showPub">true</set>
<set token="IU">$msgType$</set>
<unset token="sname"></unset>
<unset token="bet"></unset>
<unset token="showSuccess"></unset>
<unset token="showError"></unset>
</drilldown>
<option name="drilldown">all</option>
</single> 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @anilwale,

linkView isn't required: if you enabled drilldown it automatically open the search dashboard.

I 'don't know classField, sorry.

You can see in the Dashboard Examples App all the information you need https://splunkbase.splunk.com/app/1603

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @anilwale ,

please try this:

    <input type="dropdown" token="EventType">
      <label>EventType</label>
      <fieldForLabel>EventType</fieldForLabel>
      <fieldForValue>EventType</fieldForValue>
      <search>
        <query>
          $env$ source=$ProcessingNode$ $stepfilter$ $timerange$ 
          | dedup EventType 
          | $FilterEventType$
          | table EventType
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <default>*</default>
    </input>

beware that I used the field name "Time" for the time picker.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...