Dashboards & Visualizations

How to highlight eventtypes when using dropdown list?

yahooku
Explorer

Hi, I've assigned custom syles to certain eventtypes following this blog entry: Colorize your world... As usual I've built my app on top of the 'sample_app' template distributed with Splunk. Everything works fine when I use the 'Search views'->'Sample search' to list the events. The problem is that color styles don't work when I list same event types in another dashboard which uses dropdown list (lister) to narrow down search results. How can I force event (color) highlighting when using dropdown lists? I have the following code in my lister dashboard:

<form>
<label>Vulnerabilities by host</label>

<!-- define master search template, with replacement tokens delimited with $ -->
<searchTemplate>index=scs | eval time=_time | search [search index=scs hostIP="$hostIP$"  | stats latest(_time) as time2 | eval time=time2 | fields time]</searchTemplate>

<fieldset>
    <!-- Define a simple dropdown form driven by a search -->
    <input type="dropdown" token="hostIP">
        <label>Select to address</label>
        <choice value="*">Any</choice>
        <populatingSearch fieldForValue="hostIP" fieldForLabel="hostIP"><![CDATA[index=scs | stats count by hostIP]]></populatingSearch>
    </input>
</fieldset>

<row>
    <!-- output the results as a 50 row events view -->
    <event>
        <title>Vulnerabilities for the selected host</title>
        <option name="count">50</option>
    </event>
</row>

0 Karma
1 Solution

yahooku
Explorer

Ok, I've managed to make a workaround using custom js similar to this one Advanced XML - Highlight certain values in a table

View solution in original post

0 Karma

yahooku
Explorer

Ok, I've managed to make a workaround using custom js similar to this one Advanced XML - Highlight certain values in a table

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...