Dashboards & Visualizations

Calling Multiple Hidden Searches in advanced form xml

Communicator

Hi Guys,

i am trying to call multiple Hidden Searches in an advanced xml, so that i can display different charts in the same page.
But the input is a single variable from a textbox on the page
In the below written XML, i am able to call only a single Hidden Search. Here is the code.
Is it possible to call multiple searches?

Please Help.
Thanks!


<!-- autoCancelInterval is set here to 100 -->




*
False
1

<module name="HiddenSearch" layoutPanel="mainSearchControls">
<param name="search">sourcetype="*$target$*" | top limit=10 Website</param>
    <!-- apache_error *$target$ -->

<module name="ExtendedFieldSearch">
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
       <param name="target">
            <param name="default">500</param>
        </param>
    </param>
  </param>

  <param name="replacementMap">
    <param name="arg">
      <param name="target">
          <param name="value"></param>
      </param>
    </param>
  </param>
    <module name="HiddenChartFormatter">
     <param name="chart">pie</param>
      <module name="FlashChart"></module>
       </module>

  <param name="field">Wildcard search</param>

  <!-- <module name="EventsViewer" layoutPanel="resultsAreaLeft">
    <param name="segmentation">full</param>
  </module> -->

</module> <!-- End ExtendedFieldSearch -->

<!-- End HiddenSearch -->

SplunkTrust
SplunkTrust

Sure. The trick is that the ExtendedFieldSearch module doesn't actually have to be downstream from the HiddenSearch module. ExtendedFieldSearch outputs an "intention", and the HiddenSearch outputs the searchstring into which that intention will be plugged, but the two parts can happen in either order.

Thus here we just have 2 or more different HiddenSearch+HiddenChartFormatter+FlashChart blocks downstream.

<module name="ExtendedFieldSearch">
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
       <param name="target">
            <param name="default">500</param>
        </param>
    </param>
  </param>
  <param name="replacementMap">
    <param name="arg">
      <param name="target">
          <param name="value"></param>
      </param>
    </param>
  </param>
  <param name="field">Wildcard search</param>

  <module name="HiddenSearch">
    <param name="search">sourcetype="*$target$*" | top limit=10 Website</param>

    <module name="HiddenChartFormatter" layoutPanel="panel_row1_col1">
      <param name="chart">pie</param>
      <module name="FlashChart"></module>
    </module>
  </module>

  <module name="HiddenSearch">
    <param name="search">sourcetype="*$target$*" | some other search</param>

    <module name="HiddenChartFormatter" layoutPanel="panel_row2_col1">
      <param name="chart">pie</param>
      <module name="FlashChart"></module>
    </module>
  </module>
</module>

You might want to take a look at Sideview Utils, as it makes the advanced XML a great deal easier. See the testimonials page here http://sideviewapps.com/apps/sideview-utils/testimonials.

And since one of the benefits is that you don't have to think about intentions anymore, config like this becomes a lot simpler. Here for example is the same config as above but you'll see it's much easier to read.

<module name="TextField">
  <param name="name">searchterm</param>
  <param name="template">sourcetype="*$value$*"</param>
  <param name="label">Wildcard search</param>

  <module name="Search">
    <param name="search">$searchterm$ | top limit=10 Website</param>

    <module name="HiddenChartFormatter" layoutPanel="panel_row1_col1">
      <param name="chart">pie</param>
      <module name="FlashChart"></module>
    </module>
  </module>

  <module name="Search">
    <param name="search">$searchterm$ | some other search</param>

    <module name="HiddenChartFormatter" layoutPanel="panel_row2_col1">
      <param name="chart">pie</param>
      <module name="FlashChart"></module>
    </module>
  </module>
</module>

You can also watch a 10minute recorded demo that goes over Sideview Utils as a whole - http://www.youtube.com/watch?v=9UTiJ65tlmY

Communicator

Sorry!
What i meant was I am trying to Call Multiple Hidden Searches in the same Advanced XML.
So that the different charts can be displayed dashboard itself.

0 Karma

Legend

You don't really state what your problem is? Like you say your code only has a single HiddenSearch so it's not very clear what you tried and didn't work.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!