Dashboards & Visualizations

Calling Multiple Hidden Searches in advanced form xml

alenseb
Communicator

Hi Guys,

i am trying to call multiple Hidden Searches in an advanced xml, so that i can display different charts in the same page.
But the input is a single variable from a textbox on the page
In the below written XML, i am able to call only a single Hidden Search. Here is the code.
Is it possible to call multiple searches?

Please Help.
Thanks!


<!-- autoCancelInterval is set here to 100 -->




*
False
1

<module name="HiddenSearch" layoutPanel="mainSearchControls">
<param name="search">sourcetype="*$target$*" | top limit=10 Website</param>
    <!-- apache_error *$target$ -->

<module name="ExtendedFieldSearch">
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
       <param name="target">
            <param name="default">500</param>
        </param>
    </param>
  </param>

  <param name="replacementMap">
    <param name="arg">
      <param name="target">
          <param name="value"></param>
      </param>
    </param>
  </param>
    <module name="HiddenChartFormatter">
     <param name="chart">pie</param>
      <module name="FlashChart"></module>
       </module>

  <param name="field">Wildcard search</param>

  <!-- <module name="EventsViewer" layoutPanel="resultsAreaLeft">
    <param name="segmentation">full</param>
  </module> -->

</module> <!-- End ExtendedFieldSearch -->

<!-- End HiddenSearch -->

sideview
SplunkTrust
SplunkTrust

Sure. The trick is that the ExtendedFieldSearch module doesn't actually have to be downstream from the HiddenSearch module. ExtendedFieldSearch outputs an "intention", and the HiddenSearch outputs the searchstring into which that intention will be plugged, but the two parts can happen in either order.

Thus here we just have 2 or more different HiddenSearch+HiddenChartFormatter+FlashChart blocks downstream.

<module name="ExtendedFieldSearch">
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
       <param name="target">
            <param name="default">500</param>
        </param>
    </param>
  </param>
  <param name="replacementMap">
    <param name="arg">
      <param name="target">
          <param name="value"></param>
      </param>
    </param>
  </param>
  <param name="field">Wildcard search</param>

  <module name="HiddenSearch">
    <param name="search">sourcetype="*$target$*" | top limit=10 Website</param>

    <module name="HiddenChartFormatter" layoutPanel="panel_row1_col1">
      <param name="chart">pie</param>
      <module name="FlashChart"></module>
    </module>
  </module>

  <module name="HiddenSearch">
    <param name="search">sourcetype="*$target$*" | some other search</param>

    <module name="HiddenChartFormatter" layoutPanel="panel_row2_col1">
      <param name="chart">pie</param>
      <module name="FlashChart"></module>
    </module>
  </module>
</module>

You might want to take a look at Sideview Utils, as it makes the advanced XML a great deal easier. See the testimonials page here http://sideviewapps.com/apps/sideview-utils/testimonials.

And since one of the benefits is that you don't have to think about intentions anymore, config like this becomes a lot simpler. Here for example is the same config as above but you'll see it's much easier to read.

<module name="TextField">
  <param name="name">searchterm</param>
  <param name="template">sourcetype="*$value$*"</param>
  <param name="label">Wildcard search</param>

  <module name="Search">
    <param name="search">$searchterm$ | top limit=10 Website</param>

    <module name="HiddenChartFormatter" layoutPanel="panel_row1_col1">
      <param name="chart">pie</param>
      <module name="FlashChart"></module>
    </module>
  </module>

  <module name="Search">
    <param name="search">$searchterm$ | some other search</param>

    <module name="HiddenChartFormatter" layoutPanel="panel_row2_col1">
      <param name="chart">pie</param>
      <module name="FlashChart"></module>
    </module>
  </module>
</module>

You can also watch a 10minute recorded demo that goes over Sideview Utils as a whole - http://www.youtube.com/watch?v=9UTiJ65tlmY

alenseb
Communicator

Sorry!
What i meant was I am trying to Call Multiple Hidden Searches in the same Advanced XML.
So that the different charts can be displayed dashboard itself.

0 Karma

Ayn
Legend

You don't really state what your problem is? Like you say your code only has a single HiddenSearch so it's not very clear what you tried and didn't work.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...