Different text form inputs for each panel of a dashboard

[HeinzWaescher]

Hi,

is it possible to create a dashboard and define different input elements for each panel? At the moment all panels in my dashboard react with the input elements at the top. I didn't find any information in docs how to achieve this.

BR

Heinz

[wpreston · Accepted solution]

Yes, this can be done easily in simple xml, but I believe only with Splunk 6.1 and above. There is an example in the Splunk 6 Dashboard Examples app, it's called "Form Elements Within Panels". Here is the example code from that app:

<form>
    <label>Form Elements Within Panels</label>
    <description>Example of placing form elements within a panel.</description>
    <row>
        <panel>
            <input type="dropdown" token="sourcetype1" searchWhenChanged="true">
                <label>Source types for _Internal All</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>splunkd</default>
            </input>
            <chart>
                <title>_Internal All</title>
                <searchString>index=_internal sourcetype="$sourcetype1$" | timechart count</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="charting.chart">line</option>
                <option name="charting.legend.placement">none</option>
            </chart>
        </panel>
        <panel>
            <input type="radio" token="sourcetype2" searchWhenChanged="true">
                <label>Source types for _Internal Top 3</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>*</default>
            </input>
            <event>
                <title>_Internal Top 3</title>
                <searchString>index=_internal sourcetype="$sourcetype2$" | head 3</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="maxLines">5</option>
                <option name="raw.drilldown">full</option>
                <option name="rowNumbers">0</option>
                <option name="type">list</option>
                <option name="count">5</option>
            </event>
        </panel>
    </row>
</form>

If you're on version of Splunk older than 6.1, I think you'll have to use advanced XML.

[bwlm]

This form example above no longer passes validation on Splunk 8.0.1 and maybe earlier, however one can copy the latest example from within the "Dashboard Examples App".

<form>
    <label>Form Elements Within Panels</label>
    <description>Dashboard Examples: Example of placing form elements within a panel.</description>
    <row>
        <panel>
            <input type="dropdown" token="sourcetype1" searchWhenChanged="true">
                <label>Source types for _Internal All</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>splunkd</default>
            </input>
            <chart>
                <title>_Internal All</title>
                <search>
                    <query>index=_internal sourcetype="$sourcetype1$" | timechart count</query>
                    <earliest>-4h@h</earliest>
                    <latest>now</latest>
                </search>
                <option name="charting.chart">line</option>
                <option name="charting.legend.placement">none</option>
            </chart>
        </panel>
        <panel>
            <input type="radio" token="sourcetype2" searchWhenChanged="true">
                <label>Source types for _Internal Top 3</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>*</default>
            </input>
            <event>
                <title>_Internal Top 3</title>
                <search>
                    <query>index=_internal sourcetype="$sourcetype2$" | head 3</query>
                    <earliest>-4h@h</earliest>
                    <latest>now</latest>
                </search>
                <option name="maxLines">5</option>
                <option name="raw.drilldown">full</option>
                <option name="rowNumbers">0</option>
                <option name="type">list</option>
                <option name="count">5</option>
            </event>
        </panel>
    </row>
</form>

[HeinzWaescher]

Great, I'm on version 6.1 and it works fine! Thanks a lot.

Is it also possible to create a submit button for every panel? I tried to move the

<fieldset submitButton="true"> ...

to the panel level, but this caused an error.

[bhgupta]

whoa I didn't know panels could have input options; exactly the answer I was looking for. Thanks!