- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, this can be done easily in simple xml, but I believe only with Splunk 6.1 and above. There is an example in the Splunk 6 Dashboard Examples app, it's called "Form Elements Within Panels". Here is the example code from that app:
<form>
<label>Form Elements Within Panels</label>
<description>Example of placing form elements within a panel.</description>
<row>
<panel>
<input type="dropdown" token="sourcetype1" searchWhenChanged="true">
<label>Source types for _Internal All</label>
<choice value="*">All</choice>
<choice value="splunkd">splunkd</choice>
<choice value="splunk_web_access">splunk_web_access</choice>
<default>splunkd</default>
</input>
<chart>
<title>_Internal All</title>
<searchString>index=_internal sourcetype="$sourcetype1$" | timechart count</searchString>
<earliestTime>-4h@h</earliestTime>
<latestTime>now</latestTime>
<option name="charting.chart">line</option>
<option name="charting.legend.placement">none</option>
</chart>
</panel>
<panel>
<input type="radio" token="sourcetype2" searchWhenChanged="true">
<label>Source types for _Internal Top 3</label>
<choice value="*">All</choice>
<choice value="splunkd">splunkd</choice>
<choice value="splunk_web_access">splunk_web_access</choice>
<default>*</default>
</input>
<event>
<title>_Internal Top 3</title>
<searchString>index=_internal sourcetype="$sourcetype2$" | head 3</searchString>
<earliestTime>-4h@h</earliestTime>
<latestTime>now</latestTime>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="type">list</option>
<option name="count">5</option>
</event>
</panel>
</row>
</form>
If you're on version of Splunk older than 6.1, I think you'll have to use advanced XML.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, this can be done easily in simple xml, but I believe only with Splunk 6.1 and above. There is an example in the Splunk 6 Dashboard Examples app, it's called "Form Elements Within Panels". Here is the example code from that app:
<form>
<label>Form Elements Within Panels</label>
<description>Example of placing form elements within a panel.</description>
<row>
<panel>
<input type="dropdown" token="sourcetype1" searchWhenChanged="true">
<label>Source types for _Internal All</label>
<choice value="*">All</choice>
<choice value="splunkd">splunkd</choice>
<choice value="splunk_web_access">splunk_web_access</choice>
<default>splunkd</default>
</input>
<chart>
<title>_Internal All</title>
<searchString>index=_internal sourcetype="$sourcetype1$" | timechart count</searchString>
<earliestTime>-4h@h</earliestTime>
<latestTime>now</latestTime>
<option name="charting.chart">line</option>
<option name="charting.legend.placement">none</option>
</chart>
</panel>
<panel>
<input type="radio" token="sourcetype2" searchWhenChanged="true">
<label>Source types for _Internal Top 3</label>
<choice value="*">All</choice>
<choice value="splunkd">splunkd</choice>
<choice value="splunk_web_access">splunk_web_access</choice>
<default>*</default>
</input>
<event>
<title>_Internal Top 3</title>
<searchString>index=_internal sourcetype="$sourcetype2$" | head 3</searchString>
<earliestTime>-4h@h</earliestTime>
<latestTime>now</latestTime>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="type">list</option>
<option name="count">5</option>
</event>
</panel>
</row>
</form>
If you're on version of Splunk older than 6.1, I think you'll have to use advanced XML.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This form example above no longer passes validation on Splunk 8.0.1 and maybe earlier, however one can copy the latest example from within the "Dashboard Examples App".
<form>
<label>Form Elements Within Panels</label>
<description>Dashboard Examples: Example of placing form elements within a panel.</description>
<row>
<panel>
<input type="dropdown" token="sourcetype1" searchWhenChanged="true">
<label>Source types for _Internal All</label>
<choice value="*">All</choice>
<choice value="splunkd">splunkd</choice>
<choice value="splunk_web_access">splunk_web_access</choice>
<default>splunkd</default>
</input>
<chart>
<title>_Internal All</title>
<search>
<query>index=_internal sourcetype="$sourcetype1$" | timechart count</query>
<earliest>-4h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.legend.placement">none</option>
</chart>
</panel>
<panel>
<input type="radio" token="sourcetype2" searchWhenChanged="true">
<label>Source types for _Internal Top 3</label>
<choice value="*">All</choice>
<choice value="splunkd">splunkd</choice>
<choice value="splunk_web_access">splunk_web_access</choice>
<default>*</default>
</input>
<event>
<title>_Internal Top 3</title>
<search>
<query>index=_internal sourcetype="$sourcetype2$" | head 3</query>
<earliest>-4h@h</earliest>
<latest>now</latest>
</search>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="type">list</option>
<option name="count">5</option>
</event>
</panel>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great, I'm on version 6.1 and it works fine! Thanks a lot.
Is it also possible to create a submit button for every panel? I tried to move the
<fieldset submitButton="true"> ...
to the panel level, but this caused an error.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
whoa I didn't know panels could have input options; exactly the answer I was looking for. Thanks!
