Dashboards & Visualizations

Can you add a constant variable to advanced xml?

mjohanne
Explorer

I have several views that are identical except for the index they use. Is there a way to define a variable with the index name that can be used in other modules downstream? Something similar to the variables in HiddenSearch:

index_var=myindex

index=$index_var$ ....

Tags (1)
0 Karma

David
Splunk Employee
Splunk Employee

Absolutely. The most unobtrusive way to do this might be with a select box, and setting intentions. (Perhaps someone else can jump in to verify that?) Alternatively, you could add it to the context by overriding something in application.js (which is more complex).

A third way would be to use Sideview Utils, which contains the ValueSetter module that makes this process exceedingly easy. Switching to sideview is a relatively large project if you already have a lot of advanced XML out there, but relatively minor if you're just starting into the world of Advanced XML. (And it will significantly increase the functionality offered by Splunk overall, to boot).

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...