Dashboards & Visualizations

Can you add a constant variable to advanced xml?

Explorer

I have several views that are identical except for the index they use. Is there a way to define a variable with the index name that can be used in other modules downstream? Something similar to the variables in HiddenSearch:

index_var=myindex

index=$index_var$ ....

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Absolutely. The most unobtrusive way to do this might be with a select box, and setting intentions. (Perhaps someone else can jump in to verify that?) Alternatively, you could add it to the context by overriding something in application.js (which is more complex).

A third way would be to use Sideview Utils, which contains the ValueSetter module that makes this process exceedingly easy. Switching to sideview is a relatively large project if you already have a lot of advanced XML out there, but relatively minor if you're just starting into the world of Advanced XML. (And it will significantly increase the functionality offered by Splunk overall, to boot).

0 Karma