Dashboards & Visualizations

Can you use a variable in a dashboard paramater?

vbumgarner
Contributor
<param name="savedSearch">Unique_Visitors_by_Server_Saved_$timeframe$</param>
Tags (1)

sideview
SplunkTrust
SplunkTrust

i'm not entirely sure what you're asking, but I can attempt an answer.

1) if you use the systems packaged in the sideview_utils app, I'd need more details about what you're trying to do specifically, but the answer is probably 'yes'. With the newer stuff there is a great deal more flexibility to substitute $foo$ args anywhere you like.

2) if you're using the default UI, the only way you can use a $foo$ argument like this is if you have pulldown or textfield module, and that is where the $timeframe$ value is going to be coming from, and you want to get that value into a search where some part of the search is living: Unique_Visitors_by_Server_Saved_$timeframe$. then it's possible. However we need more details.

In the meantime I would check out the "UI Examples for 4.1" app on splunkbase for an example of #2 and just in general if you havent looked through that app already.

and then once you've at least read through the introductory documentation in UI Examples, download sideview_utils. The sideview_utils app is a lot like ui_examples in spirit, but it talks about the custom modules it packages and how to use them.

0 Karma

vbumgarner
Contributor

I'm sorry, I didn't notice that it was printing the param tag literally to the browser, and therefore wasn't visible.

The goal here is to use saved search results for multiple timeframes on a single dashboard. Drawing the results needs to be fast.

The other options I've encountered are a switcher module, but then the XML is very bloated, or loadjob, but it errors out if the search happens to be running at that moment.

Is there a better option?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...