How to display dashboard form choice as a chart or table title?

[joelshprentz]

How can I make a dashboard's chart or table title dynamically change when a user selects an option from a form on the dashboard?

For example, in the UI Examples application, the "autoRun example 2: form using a dropdown inputs" page at http://splunk:8000/en-US/app/ui_examples/auto_dispatch_form2 contains a form with a dropdown menu to select the pipeline process name. The choices are indexerpipe, dev-null, etc.

When a user selects one of those choices, the selected value is substituted into searches driving two charts and a table. When the user scrolls down to see the chart labeled "Cumulative hits over time," he or she can no longer see the selected pipeline process name in the form. Also, when the user copies the chart into PowerPoint, the vague label does not identify the pipeline process.

The chart title is specified like this:

<title>Cumulative hits over time</title>

How can the chart label be changed to something like "Cumulative hits over time for indexerpipe" or "Cumulative hits over time for dev-null"? I tried this:

<title>Cumulative hits over time for $process_name$</title>

but it didn't work. The chart displayed the label "Cumulative hits over time for $process_name$" in Splunk's attractive green.

I am willing to level-up to advanced XML, but I did not see a solution in its documentation either.

Thanks.

[sideview · Accepted solution]

The simplified XML cannot do this, but as you suspect, the Advanced XML can.

There are three 'header' modules in the Advanced XML --

1. GenericHeader which is static,
2. ResultsHeader which is a bit clunky and suffers from a little special-case-itis
3. SimpleResultsHeader, which is an excellent and flexible module.

Of the three, the latter can do $foo$ substitution.

To get yourself used to the Advanced XML, go through the "UI examples for 4.1" app and take your time. It really does pay off. (The docs are great but more than ten minutes of reading any documentation turns the best developer brain to porridge.) When you've got the hang of what the heck is going on with advanced XML view, here is what you're looking for:

<module name="SimpleResultsHeader">
  <param name="headerFormat">Cumulative hits over time for $process_name$</param>
  <param name="entityName">results</param>
</module>

Any 'settingToCreate' key from any lister module, or the '$charting.chart.stackMode$' key for instance from the StackModeFormatter module, or or the infamous $click.value$ from an inline table or chart drilldown -- all of those can be displayed in the header by wrapping it in $. In addition to those, there are these three other special keys:

1. $count$ is the total count of results (or the count of events if you've set entityName to 'events')
2. $time$ is a localized description of the timerange ('in the last 24 hours', 'on Tuesday April 24th 2010')
3. $search$ is the full search language string that was run. (sometimes this is quite useful for debugging)

So putting those together, if you want your header to say something like: "57 cumulative hits in the last 4 hours for indexerpipe"), you would do this:

<module name="SimpleResultsHeader">
  <param name="headerFormat">$count$ cumulative hits $time$ for $process_name$</param>
  <param name="entityName">results</param>
</module>

[joelshprentz]

Thank your very much for your well explained solution. It worked for me.

I noticed that the original green panel heading came from the group parameter of an EnablePreview module (after conversion from a dashboard to advanced XML). This is rendered as an HTML h2.

The SimpleResultsHeader renders an HTML h3 class=header, which is black.

Still, that's good enough for me. Thanks again.