Dashboards & Visualizations

Few SearchTemplate's in Dashboard for optimization?

Path Finder

Hi all!

How can I declare few different SearchTemplate's in one Dashboard with SimpleXML? I need it for optimization. Or I can do it only with AdvancedXML?

In documentation (http://docs.splunk.com/Documentation/Splunk/6.1/Viz/PanelreferenceforSimplifiedXML) I found that can be declared not only in Form, in Table/Chart/Events/... too. But, I need to declare in and use results in few Charts (maybe as PostProcess).

Thanks!

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Currently (Splunk 6.1 and prior versions), Simple XML only supports a single global searchTemplate with then multiple searchPostProcess searches from that.

To support this, you can either use Advanced XML or HTML.

View solution in original post

Splunk Employee
Splunk Employee

Splunk 6.2 now supports multiple background searches in Simple XML!

Check out the new syntax in the Splunk 6.x Dashboard Examples (https://apps.splunk.com/app/1603/).

The syntax looks something like this:

<search id="global_search">
   <query>foo</query>
   <earliest>-60h@h</earliest>
   <latest>now</latest>
</search>

<search base="global_search">
   <query>bar_1</query>
</search>

<search base="global_search">
   <query>bar_2</query>
</search>
0 Karma

Builder

My work around right now while on 6.1 is to leverage scheduled saved search results by loading them using the | loadjob search command and then postprocessing down the result set. It beats running the same search over and over again.

| loadjob savedsearch="admin:search:MySavedSearch" | search host=hostA | timechart count

| loadjob savedsearch="admin:search:MySavedSearch" | search host=hostB | timechart count

Can anyone point me to some HTML examples of using more than one search that can be post processed in a single dashboard?

0 Karma

SplunkTrust
SplunkTrust

You can try this workaround, if it suits you. In this, I have replaced searchTemplate with hidden textbox and used its default value (the search your want to execute) in the search using tokens. Below is run anywhere sample.

<form>
  <label>TestMultipleSearchTemplate</label>
  <description/>
  <fieldset submitButton="false" autoRun="true">
    <input type="text" token="search1" id="field1">
      <label>sourcetype</label>
      <default>index=_internal source="*metrics.log" group=per_sourcetype_thruput</default>      
    </input>
    <input type="text" token="search2" id="field2">
      <label>sourcetype</label>
      <default>index=_internal sourcetype=scheduler</default>      
    </input>
    <html>
      <style>.input#field1,.input#field2 { display:none; }</style>
    </html>
  </fieldset>
  <row>
    <chart>
      <title>Search1 Chart</title>
      <searchString>
        $search1$ | timechart sum(kb) by series
      </searchString>
      <earliestTime>-1h@h</earliestTime>
      <latestTime>now</latestTime>
      <option name="height">200px</option>
      <option name="charting.chart">line</option>
    </chart>
    <table>
      <title>Search1 Table</title>
      <searchString>
        $search1$ | timechart sum(kb) by series
      </searchString>
      <earliestTime>-1h@h</earliestTime>
      <latestTime>now</latestTime>
      <option name="count">5</option>     
    </table>
  </row>
   <row>
    <chart>
      <title>Search2 Chart</title>
      <searchString>
        $search2$ | timechart count
      </searchString>
      <earliestTime>-1h@h</earliestTime>
      <latestTime>now</latestTime>
      <option name="height">200px</option>
      <option name="charting.chart">line</option>
    </chart>
    <table>
      <title>Search2 Table</title>
      <searchString>
        $search2$ | timechart count
      </searchString>
      <earliestTime>-1h@h</earliestTime>
      <latestTime>now</latestTime>
      <option name="count">5</option>     
    </table>
  </row>
</form>
0 Karma

SplunkTrust
SplunkTrust

That is correct, you'll not be utilizing the performance benefit of the searchPostProcess here, but will be able to refactor code (not have to rewrite the same portion of the search multiple times). Any postProcess/Additional search will be appended after usage of token. ($tokenName$ | post process search)

0 Karma

Path Finder

Thanks! But as I understand, it's not PostProcess, it's just shared base search string?

0 Karma

Splunk Employee
Splunk Employee

Currently (Splunk 6.1 and prior versions), Simple XML only supports a single global searchTemplate with then multiple searchPostProcess searches from that.

To support this, you can either use Advanced XML or HTML.

View solution in original post

Path Finder

Ok, thanks!
Unfortunately, AdvancedXML it's not acceptable for me, because TimePicker in AdvancedXML has not so handy style as in SimpleXML (http://answers.splunk.com/answers/139525/can-i-apply-default-style-for-timerangepicker-in-advancedxm...).

0 Karma