Dashboards & Visualizations

Multiple search forms in a single line (advanced xml)?

gljiva
Path Finder

Hi, I don't know how to get multiple form search fields in a single line. I'd like to get it similar to simple xml form, where all form searches get added to single line one next to other. In advanced xml i use this code to add form searches to HiddenSearch module:

  <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Description" autoRun="True">
<param name="search">index=sth field="$to_replace$"</param>
<param name="groupLabel">Installation details</param>

<module name="TimeRangePicker">
    <param name="default">Last 7 days</param>
    <param name="searchWhenChanged">True</param>

<module name="ExtendedFieldSearch">
  <param name="field">Name</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
        <param name="to_replace">
            <param name="fillOnEmpty">True</param>
            <param name="value">*</param>
        </param>
    </param>
  </param>
  <param name="replacementMap">
    <param name="arg">
      <param name="to_replace">
          <param name="value">*</param>
      </param>
    </param>
  </param>

Problem is when I add multiple ExtendedFieldSearch modules, each gets put to a new line so it looks really bad and takes to much space. Is there some option to make them fit into single line?

0 Karma
1 Solution

hazekamp
Builder

gljiva,

You need to do this using CSS. Each view can specify it's own custom CSS file using the following syntax:

<view template="dashboard.html" stylesheet="access_center.css">

The CSS file should live in $SPLUNK_HOME/etc/apps/$your_app$/appserver/static/

Each module in the view get's an ID. This is easily retrieved using firebug. In the case of getting those to span horizontally, you will want something like this:

#ExtendedFieldSearch_0_8_0 {
    float: left;
    padding-top: 2px;
}

View solution in original post

gljiva
Path Finder

Thanks, it works great! Only problem with this was that Paginator would also get positioned on the same line as the search fields. Solution is to add some html code to xml before Paginator module. This way Paginator will get positioned to a new line and be left aligned.

    <module name="StaticContentSample">
        <param name="text">&lt;br&gt;&lt;br&gt;&lt;br&gt;</param>
    </module>

    <module name="Paginator">
    ....
0 Karma

hazekamp
Builder

gljiva,

You need to do this using CSS. Each view can specify it's own custom CSS file using the following syntax:

<view template="dashboard.html" stylesheet="access_center.css">

The CSS file should live in $SPLUNK_HOME/etc/apps/$your_app$/appserver/static/

Each module in the view get's an ID. This is easily retrieved using firebug. In the case of getting those to span horizontally, you will want something like this:

#ExtendedFieldSearch_0_8_0 {
    float: left;
    padding-top: 2px;
}
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...