Dashboards & Visualizations

Dashboard with multiple searches for searchPostProcess SV panels?

pde
Path Finder

I'd like to build a dashboard (or form, or view) that has three rows. Within each row are three SV panels. The SV panels in each row display three different fields from a single search, but the three rows represent three different searches.

It seems that I can use a form with a searchTemplate and <searchPostProcess> elements in each SV panel on the first row, but the RelaxNG schemas for dashboard, form, and view do not seem to allow me to specify row-level searches to be leveraged by each panel in the row.

As far as I can tell, my options are to end up with 7 total searches running on the page (highly suboptimal) or attempting to mash together the three (already fairly complex) searches into a single ginormous master search.

Have I missed another way?

Thanks

1 Solution

sideview
SplunkTrust
SplunkTrust

That's correct, as is Gerald's answer.

read through the copy and the XML in the ui_examples app. It builds up from a simple hello world style examples and if you follow along from the beginning you'll be able to follow the example called 'using dashboards with postprocess' where this kind of config is explained and illustrated.

View solution in original post

sideview
SplunkTrust
SplunkTrust

That's correct, as is Gerald's answer.

read through the copy and the XML in the ui_examples app. It builds up from a simple hello world style examples and if you follow along from the beginning you'll be able to follow the example called 'using dashboards with postprocess' where this kind of config is explained and illustrated.

sideview
SplunkTrust
SplunkTrust

I'd take a couple steps back and reread the copy in the intro pages of the ui_examples app. It gives you the basic grounding of what the nesting of the module tags means, and what modules know what when. But basically all the modules within a given HiddenSearch module will know about, and operate with, that search.

0 Karma

pde
Path Finder

Ah, there we go. Thanks, Nick!

So if I grok the example correctly, I use a series of HiddenSearch modules, and the searches have module-level locality, right?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You are correct. In the Simple XML, you may either have a single search and multiple post processes from that search, or you may have multiple independent searches. To do what you want is possible in the Advanced XML.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...