Dashboards & Visualizations

Automatically run searchPostProcess in a simple XML dashboard?

msarro
Builder

Hello, I am trying to create a dashboard which will eventually be implemented in advanced XML, but the more I can do in simple xml the better.

That said, I am having issue trying to get this to work. I have a searchTemplate, and my panels each has a searchPostProcess element. However, unless I convert the dashboard to a form and include some sort of fieldset (somewhere I can hit "submit", the panels just sit there with no value. Once I hit the submit button, they work.

Is there a way to get it to autorun? Ultimately this dashboard doesn't need user input, it should just run. I know that there is an auto-run option for some of the elements but I can't seem to find a decent reference for simple XML.

Tags (1)
0 Karma
1 Solution

msarro
Builder

I was able to get it to work this way:

?xml version='1.0' encoding='utf-8'?
form
  fieldset autoRun="true" submitButton="false"
  /fieldset
earliestTime -30d@d /earliestTime

View solution in original post

msarro
Builder

I was able to get it to work this way:

?xml version='1.0' encoding='utf-8'?
form
  fieldset autoRun="true" submitButton="false"
  /fieldset
earliestTime -30d@d /earliestTime

msarro
Builder

The major goal was to avoid having the same base search run 7+ times for what will eventually be 12 different tabs on each page. It wouldn't be a big deal except the base search is somewhat lengthy to run.

0 Karma

aholzer
Motivator

Is there any reason you are using a searchTemplate rather than a saved search for your base search?

I believe that the simple XML requires you to define an input if you have a searchTemplate. If you use a saved search on the other hand I believe it defaults to "autorun=true".

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...