Dashboards & Visualizations

Automatically run searchPostProcess in a simple XML dashboard?

msarro
Builder

Hello, I am trying to create a dashboard which will eventually be implemented in advanced XML, but the more I can do in simple xml the better.

That said, I am having issue trying to get this to work. I have a searchTemplate, and my panels each has a searchPostProcess element. However, unless I convert the dashboard to a form and include some sort of fieldset (somewhere I can hit "submit", the panels just sit there with no value. Once I hit the submit button, they work.

Is there a way to get it to autorun? Ultimately this dashboard doesn't need user input, it should just run. I know that there is an auto-run option for some of the elements but I can't seem to find a decent reference for simple XML.

Tags (1)
0 Karma
1 Solution

msarro
Builder

I was able to get it to work this way:

?xml version='1.0' encoding='utf-8'?
form
  fieldset autoRun="true" submitButton="false"
  /fieldset
earliestTime -30d@d /earliestTime

View solution in original post

msarro
Builder

I was able to get it to work this way:

?xml version='1.0' encoding='utf-8'?
form
  fieldset autoRun="true" submitButton="false"
  /fieldset
earliestTime -30d@d /earliestTime

msarro
Builder

The major goal was to avoid having the same base search run 7+ times for what will eventually be 12 different tabs on each page. It wouldn't be a big deal except the base search is somewhat lengthy to run.

0 Karma

aholzer
Motivator

Is there any reason you are using a searchTemplate rather than a saved search for your base search?

I believe that the simple XML requires you to define an input if you have a searchTemplate. If you use a saved search on the other hand I believe it defaults to "autorun=true".

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...