Dashboards & Visualizations

Different text form inputs for each panel of a dashboard

HeinzWaescher
Motivator

Hi,

is it possible to create a dashboard and define different input elements for each panel? At the moment all panels in my dashboard react with the input elements at the top. I didn't find any information in docs how to achieve this.

BR

Heinz

0 Karma
1 Solution

wpreston
Motivator

Yes, this can be done easily in simple xml, but I believe only with Splunk 6.1 and above. There is an example in the Splunk 6 Dashboard Examples app, it's called "Form Elements Within Panels". Here is the example code from that app:

<form>
    <label>Form Elements Within Panels</label>
    <description>Example of placing form elements within a panel.</description>
    <row>
        <panel>
            <input type="dropdown" token="sourcetype1" searchWhenChanged="true">
                <label>Source types for _Internal All</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>splunkd</default>
            </input>
            <chart>
                <title>_Internal All</title>
                <searchString>index=_internal sourcetype="$sourcetype1$" | timechart count</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="charting.chart">line</option>
                <option name="charting.legend.placement">none</option>
            </chart>
        </panel>
        <panel>
            <input type="radio" token="sourcetype2" searchWhenChanged="true">
                <label>Source types for _Internal Top 3</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>*</default>
            </input>
            <event>
                <title>_Internal Top 3</title>
                <searchString>index=_internal sourcetype="$sourcetype2$" | head 3</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="maxLines">5</option>
                <option name="raw.drilldown">full</option>
                <option name="rowNumbers">0</option>
                <option name="type">list</option>
                <option name="count">5</option>
            </event>
        </panel>
    </row>
</form>

If you're on version of Splunk older than 6.1, I think you'll have to use advanced XML.

View solution in original post

wpreston
Motivator

Yes, this can be done easily in simple xml, but I believe only with Splunk 6.1 and above. There is an example in the Splunk 6 Dashboard Examples app, it's called "Form Elements Within Panels". Here is the example code from that app:

<form>
    <label>Form Elements Within Panels</label>
    <description>Example of placing form elements within a panel.</description>
    <row>
        <panel>
            <input type="dropdown" token="sourcetype1" searchWhenChanged="true">
                <label>Source types for _Internal All</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>splunkd</default>
            </input>
            <chart>
                <title>_Internal All</title>
                <searchString>index=_internal sourcetype="$sourcetype1$" | timechart count</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="charting.chart">line</option>
                <option name="charting.legend.placement">none</option>
            </chart>
        </panel>
        <panel>
            <input type="radio" token="sourcetype2" searchWhenChanged="true">
                <label>Source types for _Internal Top 3</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>*</default>
            </input>
            <event>
                <title>_Internal Top 3</title>
                <searchString>index=_internal sourcetype="$sourcetype2$" | head 3</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="maxLines">5</option>
                <option name="raw.drilldown">full</option>
                <option name="rowNumbers">0</option>
                <option name="type">list</option>
                <option name="count">5</option>
            </event>
        </panel>
    </row>
</form>

If you're on version of Splunk older than 6.1, I think you'll have to use advanced XML.

bwlm
Path Finder

This form example above no longer passes validation on Splunk 8.0.1 and maybe earlier, however one can copy the latest example from within the "Dashboard Examples App".

<form>
    <label>Form Elements Within Panels</label>
    <description>Dashboard Examples: Example of placing form elements within a panel.</description>
    <row>
        <panel>
            <input type="dropdown" token="sourcetype1" searchWhenChanged="true">
                <label>Source types for _Internal All</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>splunkd</default>
            </input>
            <chart>
                <title>_Internal All</title>
                <search>
                    <query>index=_internal sourcetype="$sourcetype1$" | timechart count</query>
                    <earliest>-4h@h</earliest>
                    <latest>now</latest>
                </search>
                <option name="charting.chart">line</option>
                <option name="charting.legend.placement">none</option>
            </chart>
        </panel>
        <panel>
            <input type="radio" token="sourcetype2" searchWhenChanged="true">
                <label>Source types for _Internal Top 3</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>*</default>
            </input>
            <event>
                <title>_Internal Top 3</title>
                <search>
                    <query>index=_internal sourcetype="$sourcetype2$" | head 3</query>
                    <earliest>-4h@h</earliest>
                    <latest>now</latest>
                </search>
                <option name="maxLines">5</option>
                <option name="raw.drilldown">full</option>
                <option name="rowNumbers">0</option>
                <option name="type">list</option>
                <option name="count">5</option>
            </event>
        </panel>
    </row>
</form>

0 Karma

HeinzWaescher
Motivator

Great, I'm on version 6.1 and it works fine! Thanks a lot.

Is it also possible to create a submit button for every panel? I tried to move the

<fieldset submitButton="true"> ...

to the panel level, but this caused an error.

bhgupta
Engager

whoa I didn't know panels could have input options; exactly the answer I was looking for. Thanks!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...