How to merge Google Maps XML with my dashboard XML?

[wojtek_swiatek]

Hello

I created my first map with the Google Maps app. Looks great.

I now want to place this map in a new panel in an existing dashboard. I read from the docs that I should add the following example XML

<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="true">  
    <param name="search">sourcetype=access_combined | geoip clientip</param>  
    <param name="earliest">-24h@h</param>  
    <module name="GoogleMaps">  
        <param name="height">500px</param>  
        <param name="mapType">roadmap</param>  
        <param name="scrollwheel">off</param>  
    </module>  
</module>

to my "advanced XML" (which does not exist anymore in 6.x, there is just "XML"). When I look at my dashboard I see the follwing XML

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>UnderConstruction</label>
  <row>
    <chart>
      <searchString>my search string here</searchString>
      <title>a panel</title>
      <earliestTime>-75d@d</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.chart">column</option>
      <option name="charting.chart.stackMode">stacked</option>
      <option name="count">50</option>
      <option name="displayRowNumbers">true</option>
      <option name="drilldown">row</option>
    </chart>
  </row>
  <row>
    <chart>
      <searchName>something</searchName>
      <title>another panel</title>
      <option name="charting.chart">column</option>
    </chart>
  </row>
</dashboard>

My question is: how do I fit the first XML in the second one? (I do not see any common points, tried to put the module as if it was a chart but I get errors).

Thank you in advance for any pointers!

[martin_mueller · Accepted solution]

Yeah, there's this: http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/Visualizationreference#Maps and this: http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/PanelreferenceforSimplifiedXML#map
Additionally available since 6.1, you can now configure many of the <map> element's settings through the visual panel editor without a need to go down to XML.

[martin_mueller]

Do you?

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/iplocation

[wojtek_swiatek]

Thanks, the new map is much better. I was about to remove the old one when I realized that I will still need to geoip script to map IPs to locations.

[wojtek_swiatek]

Ha, I did not known that there was something else available. I found this link: http://docs.splunk.com/Documentation/Splunk/6.0/Viz/Visualizationreference#Maps, would this be the one you mention? (and yes, the docs are down)

[martin_mueller]

You can convert a SimpleXML dashboard to AdvancedXML by appending ?showsource=advanced to its URL.

However, I wouldn't recommend that on 6.1. SimpleXML is gaining in features and is much easier to use. Have you considered using the built in Splunk Maps instead?
I'd post a Splunk Docs link, but they're down for scheduled maintenance...

[wojtek_swiatek]

I found the following posts: http://answers.splunk.com/answers/109408/splunk-6-converting-simple-xml-to-advanced-xml-with-saved-s... and http://answers.splunk.com/answers/118781/splunk-6-advanced-xml which do no tell where to actually find this AdvancedXML but are a bit unsettling as of Google Maps support (since it uses AdvancedXML)

[wojtek_swiatek]

I am on 6.1. The second XML is what I get when I go to Edit -> Edit Source on my dashboard. Where can I find the Advanced XML version?

[martin_mueller]

The first bit is AdvancedXML, the second bit is SimpleXML - those aren't syntactically compatible.

What version of Splunk are you on?