Solved: How to add a subtitle in simple xml?

RiccardoV · ‎05-27-2014

Hi, I am building a dashboard using Splunk 6.1.1 and Simple Xml.
I have a table like this:

<table>
  <title>IP grouped by country</title>
  <searchPostProcess>| stats count by country</searchPostProcess>
  <option name="link.visible">false</option>
  <drilldown>
    <set token="categories">$row.country$</set>
  </drilldown>
</table>

I have a drilldown here, and I would like to add a line saying "click on a row for more details". How can I add a text line (like a subtitle) under the title of the table? I tried with the tags <label> and <description> with no success.

thanks!

somesoni2 · ‎05-27-2014

You may want to remove the title from

and display the table in html module itself.

<row grouping="2">
    <html>
    <h2>Table Title</h2><br/>
    Click on the row
    </html>
    <table>      
      <searchString>|stats count  | eval Metric="$Metric$" | table Metric</searchString>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>     
    </table>
  </row>

View solution in original post

nfilippi_splunk · ‎05-27-2014

@somesoni2 is spot on here!

If you are using 6.1+, I would recommend the use of rather than row grouping, as the preferred/explicit syntax moving forward. In this case, you want both of these dashboard elements to be contained within the same panel, so the syntax should look something like this.

<row>
    <panel>
       <html>
          <h2>Table Title</h2><br/>
             Click on the row
       </html>
       <table>      
          <searchString>|stats count  | eval Metric="$Metric$" | table Metric</searchString>
          <earliestTime>-1d</earliestTime>
          <latestTime>now</latestTime>     
       </table>
   </panel>
</row>

RiccardoV · ‎05-28-2014

thanks for your answer, but maybe the app will be used on some splunk 6.0, I don't know exactly which version they will use!

somesoni2 · ‎05-27-2014

You may want to remove the title from

and display the table in html module itself.

<row grouping="2">
    <html>
    <h2>Table Title</h2><br/>
    Click on the row
    </html>
    <table>      
      <searchString>|stats count  | eval Metric="$Metric$" | table Metric</searchString>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>     
    </table>
  </row>

RiccardoV · ‎05-27-2014

grouping="2" made my day, thanks!

DavidHourani · ‎05-27-2014

You could simply add a small HTML pannel saying "click on a row for more details" and have that panel added to the same group as your table 🙂

How to add a subtitle in simple xml?

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

AppDynamics is now part of Splunk Ideas

Advanced Splunk Data Management Strategies