Dashboards & Visualizations

Advanced XML dashboard template stops dashboard from loading

watsm10
Communicator

Hi,

I'm trying to create a dashboard using advanced XML. I have created a view which has two self populating drop down boxes which produce a single value and pie chart. I want to get each chart into a separate panel like the simple XML customisable views.

<view onunloadCancelJobs="False" autoCancelInterval="100">
<label>
    Dynamic Drop Down Test
</label>
<module name="AccountBar" layoutPanel="appHeader" />
<module name="AppBar" layoutPanel="navigationHeader" />
<module name="Message" layoutPanel="messaging">
    <param name="filter">
        *
    </param>
    <param name="clearOnJobDispatch">
        False
    </param>
    <param name="maxSize">
        1
    </param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">
        dashboard
    </param>
</module>
<module name="SearchSelectLister" layoutPanel="mainSearchControls" autoRun="True">
    <param name="staticFieldsToDisplay">
        <list>
            <param name="value">*
            </param>
            <param name="label">
                All
            </param>
        </list>
    </param>
    <param name="search">SEARCH HERE
    </param>
    <param name="label">
        Select a Service:
    </param>
    <param name="settingToCreate">
        service_setting
    </param>
    <param name="searchFieldsToDisplay">
        <list>
            <param name="value">
                perf4j_servicename
            </param>
            <param name="label">
                perf4j_servicename
            </param>
        </list>
    </param>
    <module name="ConvertToIntention">
        <param name="settingToConvert">
            service_setting
        </param>
        <param name="intention">
            <param name="name">
                stringreplace
            </param>
            <param name="arg">
                <param name="serviceToken">
                    <param name="value">
                        $target$
                    </param>
                </param>
            </param>
        </param>
        <module name="SearchSelectLister">
            <param name="staticFieldsToDisplay">
                <list>
                    <param name="value">
                        *
                    </param>
                    <param name="label">
                        All
                    </param>
                </list>
            </param>
            <param name="searchWhenChanged">
                True
            </param>
            <param name="settingToCreate">
                user_setting
            </param>
            <param name="label">
                Select a User:
            </param>
            <param name="applyOuterIntentionsToInternalSearch">
                True
            </param>
            <param name="search">SEARCH HERE
            </param>
            <param name="searchFieldsToDisplay">
                <list>
                    <param name="label">
                        USER
                    </param>
                    <param name="value">
                        USER
                    </param>
                </list>
            </param>
            <module name="ConvertToIntention">
                <param name="settingToConvert">
                    user_setting
                </param>
                <param name="intention">
                    <param name="name">
                        stringreplace
                    </param>
                    <param name="arg">
                        <param name="userToken">
                            <param name="value">
                                $target$
                            </param>
                        </param>
                    </param>
                </param>
                <module name="Message" layoutPanel="graphArea">
                    <param name="filter">
                        splunk.search.job
                    </param>
                    <param name="clearOnJobDispatch">
                        True
                    </param>
                    <param name="maxSize">
                        10
                    </param>
                    <module name="GenericHeader" layoutPanel="resultsAreaLeft">
                        <param name="label">
                            Transaction Count
                        </param>
                    </module>
                    <module name="HiddenSearch" layoutPanel="resultsAreaLeft">
                        <param name="search">SEARCH HERE</param>
                        <module name="HiddenChartFormatter">
                            <module name="SingleValue">
                                <module name="JobProgressIndicator" />
                            </module>
                        </module>
                    </module>
                    <module name="GenericHeader" layoutPanel="resultsAreaRight">
                        <param name="label">
                            Success Rate
                        </param>
                    </module>
                    <module name="HiddenSearch" layoutPanel="resultsAreaRight">
                        <param name="search">SEARCH HERE</param>
                        <module name="HiddenChartFormatter">
                            <param name="chart">
                                pie
                            </param>
                            <param name="chart.stackMode">
                                default
                            </param>
                            <param name="charting.legend.masterLegend" />
                            <param name="charting.seriesColors">
                                [0x00FF00,0xFF0000]
                            </param>
                            <module name="FlashChart">
                                <param name="width">
                                    100%
                                </param>
                                <param name="height">
                                    300px
                                </param>
                            </module>
                            <module name="SimpleResultsTable" />
                            <module name="JobProgressIndicator" />
                        </module>
                    </module>
                </module>
            </module>
        </module>
    </module>
</module>

Every time I enter template=dashboard.html as an attribute for view and change the hiddensearch attributes to rows and columns the dashboard displays the charts in panels, but the searches/dropdowns/charts etc fail to load. Can anybody tell me why?

1 Solution

sideview
SplunkTrust
SplunkTrust

It fails because the XML contains layoutPanel attribute values that are valid only in the search.html template.

The top layoutPanels are the same in both views, ie appHeader, navigationHeader, viewHeader, mainSearchControls, messaging, etc...

but below those the search.html template has one set of layoutPanels like sidebar, resultsAreaLeft, resultsAreaRight, pageControls, graphArea, etc...

and the dashboard.html template has a different set of valid layout panel attributes that all look like panel_row1_col1, panel_row1_col2, panel_row5_col1, etc...

View solution in original post

sideview
SplunkTrust
SplunkTrust

It fails because the XML contains layoutPanel attribute values that are valid only in the search.html template.

The top layoutPanels are the same in both views, ie appHeader, navigationHeader, viewHeader, mainSearchControls, messaging, etc...

but below those the search.html template has one set of layoutPanels like sidebar, resultsAreaLeft, resultsAreaRight, pageControls, graphArea, etc...

and the dashboard.html template has a different set of valid layout panel attributes that all look like panel_row1_col1, panel_row1_col2, panel_row5_col1, etc...

sideview
SplunkTrust
SplunkTrust

There's good documentation here http://docs.splunk.com/Documentation/Splunk/5.0.2/AdvancedDev/AdvancedSearch about the search.html template, and here http://docs.splunk.com/Documentation/Splunk/5.0.2/AdvancedDev/AdvancedDashboard about the dashboard.html template. Both include what looks like a pretty thorough discussion of all the legal layoutPanel attribute values.

0 Karma

iKate
Builder

@sideview thanks for the answer, I had the same problems as the autor. Do layoutPanels that can be used along with search.html described somewhere?

0 Karma

sideview
SplunkTrust
SplunkTrust

Anytime, by the way if you want me to convert this view to use Sideview Utils modules it'll get a lot shorter and simpler... It wont affect your layoutPanel issue one way or another but switching would make the view easier to deal with. It only takes me a couple minutes and I'd be happy to post the converted syntax for you.

watsm10
Communicator

Thanks again for your help 🙂

0 Karma

sideview
SplunkTrust
SplunkTrust

You just make sure that it's in panel_row1_col1 and that it's the only one in that row. ie there is no panel_row1_col2. So put some modules into panel_row1_col1, and other modules into panel_row2_col1.

watsm10
Communicator

Thanks! How can you specify that a module takes up an entire row? panel_row1 on its own doesn't work.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...