Dashboards & Visualizations

How to arrange the text inputs on my dashboard form?

HeinzWaescher
Motivator

Hi,

there are 4 text inputs in my form dashboard:

input1 input2 input3 input4

Is it possible to rearrange them (force a "new line" after input2)?

input1 input2
input3 input4
Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this

<form>
  <label>InputsIntwoRows</label> 
  <fieldset autoRun="false" submitButton="true">
    <input type="time">
      <default>
        <earliestTime>-24h@h</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    <input type="dropdown" token="varIndex" id="field1">
      <label>Index :</label>
      <default>clm_stage</default>
      <populatingSearch fieldForValue="index" fieldForLabel="index">
        <![CDATA[| eventcount summarize=false index=* | dedup index ]]>
      </populatingSearch>
    </input>   
    <input type="dropdown" token="varSourceType" id="field2">
      <label>Source Type :</label>
      <default>*</default>
      <choice value="*">All</choice>
      <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype">
        <![CDATA[index=$varIndex$| stats count by sourcetype | fields sourcetype]]>
      </populatingSearch>
    </input>
     <html>
<br></br>   
      <br></br> 
      <br></br> 
      <br></br> 
       <br></br> 
    </html>
    <input type="dropdown" token="varSource" id="field3">
      <label>Source/File :</label>
      <default>*</default>
      <choice value="*">All</choice>
      <populatingSearch fieldForValue="source" fieldForLabel="source">
        <![CDATA[ index=$varIndex$ sourcetype=$varSourceType$| stats count by source | fields source | eval source=replace(source,"\\x5c","\\\\") ]]>
      </populatingSearch>
    </input>    
    <input type="text" token="varFilter">
      <label>Additional Filter (use '*' for exceptions, 'logEntryType=Summary' for transactions):</label>
      <default>logEntryType=Summary</default>
    </input>
  </fieldset>
  <row>
    <table>
      <title>Date</title>
      <searchString>index=$varIndex$ sourcetype=$varSourceType$ source=$varSource$ $varFilter$ |timechart count</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
      <option name="wrap">false</option>
      <option name="rowNumbers">false</option>
      <option name="dataOverlayMode">none</option>
      <option name="drilldown">none</option>
      <option name="count">5</option>
    </table>
  </row>
</form>

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try something like this

<form>
  <label>InputsIntwoRows</label> 
  <fieldset autoRun="false" submitButton="true">
    <input type="time">
      <default>
        <earliestTime>-24h@h</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    <input type="dropdown" token="varIndex" id="field1">
      <label>Index :</label>
      <default>clm_stage</default>
      <populatingSearch fieldForValue="index" fieldForLabel="index">
        <![CDATA[| eventcount summarize=false index=* | dedup index ]]>
      </populatingSearch>
    </input>   
    <input type="dropdown" token="varSourceType" id="field2">
      <label>Source Type :</label>
      <default>*</default>
      <choice value="*">All</choice>
      <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype">
        <![CDATA[index=$varIndex$| stats count by sourcetype | fields sourcetype]]>
      </populatingSearch>
    </input>
     <html>
<br></br>   
      <br></br> 
      <br></br> 
      <br></br> 
       <br></br> 
    </html>
    <input type="dropdown" token="varSource" id="field3">
      <label>Source/File :</label>
      <default>*</default>
      <choice value="*">All</choice>
      <populatingSearch fieldForValue="source" fieldForLabel="source">
        <![CDATA[ index=$varIndex$ sourcetype=$varSourceType$| stats count by source | fields source | eval source=replace(source,"\\x5c","\\\\") ]]>
      </populatingSearch>
    </input>    
    <input type="text" token="varFilter">
      <label>Additional Filter (use '*' for exceptions, 'logEntryType=Summary' for transactions):</label>
      <default>logEntryType=Summary</default>
    </input>
  </fieldset>
  <row>
    <table>
      <title>Date</title>
      <searchString>index=$varIndex$ sourcetype=$varSourceType$ source=$varSource$ $varFilter$ |timechart count</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
      <option name="wrap">false</option>
      <option name="rowNumbers">false</option>
      <option name="dataOverlayMode">none</option>
      <option name="drilldown">none</option>
      <option name="count">5</option>
    </table>
  </row>
</form>

Kawtar
Path Finder

Thanks (y)

0 Karma

HeinzWaescher
Motivator

Thanks a lot!

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...