Dashboards & Visualizations

How to add a subtitle in simple xml?

RiccardoV
Communicator

Hi, I am building a dashboard using Splunk 6.1.1 and Simple Xml.
I have a table like this:

<table>
  <title>IP grouped by country</title>
  <searchPostProcess>| stats count by country</searchPostProcess>
  <option name="link.visible">false</option>
  <drilldown>
    <set token="categories">$row.country$</set>
  </drilldown>
</table>

my table

I have a drilldown here, and I would like to add a line saying "click on a row for more details". How can I add a text line (like a subtitle) under the title of the table? I tried with the tags <label> and <description> with no success.

thanks!

1 Solution

somesoni2
Revered Legend

You may want to remove the title from

and display the table in html module itself.

<row grouping="2">
    <html>
    <h2>Table Title</h2><br/>
    Click on the row
    </html>
    <table>      
      <searchString>|stats count  | eval Metric="$Metric$" | table Metric</searchString>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>     
    </table>
  </row>

View solution in original post

nfilippi_splunk
Splunk Employee
Splunk Employee

@somesoni2 is spot on here!

If you are using 6.1+, I would recommend the use of rather than row grouping, as the preferred/explicit syntax moving forward. In this case, you want both of these dashboard elements to be contained within the same panel, so the syntax should look something like this.

<row>
    <panel>
       <html>
          <h2>Table Title</h2><br/>
             Click on the row
       </html>
       <table>      
          <searchString>|stats count  | eval Metric="$Metric$" | table Metric</searchString>
          <earliestTime>-1d</earliestTime>
          <latestTime>now</latestTime>     
       </table>
   </panel>
</row>

RiccardoV
Communicator

thanks for your answer, but maybe the app will be used on some splunk 6.0, I don't know exactly which version they will use!

0 Karma

somesoni2
Revered Legend

You may want to remove the title from

and display the table in html module itself.

<row grouping="2">
    <html>
    <h2>Table Title</h2><br/>
    Click on the row
    </html>
    <table>      
      <searchString>|stats count  | eval Metric="$Metric$" | table Metric</searchString>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>     
    </table>
  </row>

RiccardoV
Communicator

grouping="2" made my day, thanks!

0 Karma

DavidHourani
Super Champion

You could simply add a small HTML pannel saying "click on a row for more details" and have that panel added to the same group as your table 🙂

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...