Dashboards & Visualizations

Can you add a constant variable to advanced xml?

mjohanne
Explorer

I have several views that are identical except for the index they use. Is there a way to define a variable with the index name that can be used in other modules downstream? Something similar to the variables in HiddenSearch:

index_var=myindex

index=$index_var$ ....

Tags (1)
0 Karma

David
Splunk Employee
Splunk Employee

Absolutely. The most unobtrusive way to do this might be with a select box, and setting intentions. (Perhaps someone else can jump in to verify that?) Alternatively, you could add it to the context by overriding something in application.js (which is more complex).

A third way would be to use Sideview Utils, which contains the ValueSetter module that makes this process exceedingly easy. Switching to sideview is a relatively large project if you already have a lot of advanced XML out there, but relatively minor if you're just starting into the world of Advanced XML. (And it will significantly increase the functionality offered by Splunk overall, to boot).

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...