Dashboards & Visualizations

Calling Multiple Hidden Searches in advanced form xml

alenseb
Communicator

Hi Guys,

i am trying to call multiple Hidden Searches in an advanced xml, so that i can display different charts in the same page.
But the input is a single variable from a textbox on the page
In the below written XML, i am able to call only a single Hidden Search. Here is the code.
Is it possible to call multiple searches?

Please Help.
Thanks!


<!-- autoCancelInterval is set here to 100 -->




*
False
1

<module name="HiddenSearch" layoutPanel="mainSearchControls">
<param name="search">sourcetype="*$target$*" | top limit=10 Website</param>
    <!-- apache_error *$target$ -->

<module name="ExtendedFieldSearch">
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
       <param name="target">
            <param name="default">500</param>
        </param>
    </param>
  </param>

  <param name="replacementMap">
    <param name="arg">
      <param name="target">
          <param name="value"></param>
      </param>
    </param>
  </param>
    <module name="HiddenChartFormatter">
     <param name="chart">pie</param>
      <module name="FlashChart"></module>
       </module>

  <param name="field">Wildcard search</param>

  <!-- <module name="EventsViewer" layoutPanel="resultsAreaLeft">
    <param name="segmentation">full</param>
  </module> -->

</module> <!-- End ExtendedFieldSearch -->

<!-- End HiddenSearch -->

sideview
SplunkTrust
SplunkTrust

Sure. The trick is that the ExtendedFieldSearch module doesn't actually have to be downstream from the HiddenSearch module. ExtendedFieldSearch outputs an "intention", and the HiddenSearch outputs the searchstring into which that intention will be plugged, but the two parts can happen in either order.

Thus here we just have 2 or more different HiddenSearch+HiddenChartFormatter+FlashChart blocks downstream.

<module name="ExtendedFieldSearch">
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
       <param name="target">
            <param name="default">500</param>
        </param>
    </param>
  </param>
  <param name="replacementMap">
    <param name="arg">
      <param name="target">
          <param name="value"></param>
      </param>
    </param>
  </param>
  <param name="field">Wildcard search</param>

  <module name="HiddenSearch">
    <param name="search">sourcetype="*$target$*" | top limit=10 Website</param>

    <module name="HiddenChartFormatter" layoutPanel="panel_row1_col1">
      <param name="chart">pie</param>
      <module name="FlashChart"></module>
    </module>
  </module>

  <module name="HiddenSearch">
    <param name="search">sourcetype="*$target$*" | some other search</param>

    <module name="HiddenChartFormatter" layoutPanel="panel_row2_col1">
      <param name="chart">pie</param>
      <module name="FlashChart"></module>
    </module>
  </module>
</module>

You might want to take a look at Sideview Utils, as it makes the advanced XML a great deal easier. See the testimonials page here http://sideviewapps.com/apps/sideview-utils/testimonials.

And since one of the benefits is that you don't have to think about intentions anymore, config like this becomes a lot simpler. Here for example is the same config as above but you'll see it's much easier to read.

<module name="TextField">
  <param name="name">searchterm</param>
  <param name="template">sourcetype="*$value$*"</param>
  <param name="label">Wildcard search</param>

  <module name="Search">
    <param name="search">$searchterm$ | top limit=10 Website</param>

    <module name="HiddenChartFormatter" layoutPanel="panel_row1_col1">
      <param name="chart">pie</param>
      <module name="FlashChart"></module>
    </module>
  </module>

  <module name="Search">
    <param name="search">$searchterm$ | some other search</param>

    <module name="HiddenChartFormatter" layoutPanel="panel_row2_col1">
      <param name="chart">pie</param>
      <module name="FlashChart"></module>
    </module>
  </module>
</module>

You can also watch a 10minute recorded demo that goes over Sideview Utils as a whole - http://www.youtube.com/watch?v=9UTiJ65tlmY

alenseb
Communicator

Sorry!
What i meant was I am trying to Call Multiple Hidden Searches in the same Advanced XML.
So that the different charts can be displayed dashboard itself.

0 Karma

Ayn
Legend

You don't really state what your problem is? Like you say your code only has a single HiddenSearch so it's not very clear what you tried and didn't work.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...