Dashboards & Visualizations

Multiple search forms in a single line (advanced xml)?

gljiva
Path Finder

Hi, I don't know how to get multiple form search fields in a single line. I'd like to get it similar to simple xml form, where all form searches get added to single line one next to other. In advanced xml i use this code to add form searches to HiddenSearch module:

  <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Description" autoRun="True">
<param name="search">index=sth field="$to_replace$"</param>
<param name="groupLabel">Installation details</param>

<module name="TimeRangePicker">
    <param name="default">Last 7 days</param>
    <param name="searchWhenChanged">True</param>

<module name="ExtendedFieldSearch">
  <param name="field">Name</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
        <param name="to_replace">
            <param name="fillOnEmpty">True</param>
            <param name="value">*</param>
        </param>
    </param>
  </param>
  <param name="replacementMap">
    <param name="arg">
      <param name="to_replace">
          <param name="value">*</param>
      </param>
    </param>
  </param>

Problem is when I add multiple ExtendedFieldSearch modules, each gets put to a new line so it looks really bad and takes to much space. Is there some option to make them fit into single line?

0 Karma
1 Solution

hazekamp
Builder

gljiva,

You need to do this using CSS. Each view can specify it's own custom CSS file using the following syntax:

<view template="dashboard.html" stylesheet="access_center.css">

The CSS file should live in $SPLUNK_HOME/etc/apps/$your_app$/appserver/static/

Each module in the view get's an ID. This is easily retrieved using firebug. In the case of getting those to span horizontally, you will want something like this:

#ExtendedFieldSearch_0_8_0 {
    float: left;
    padding-top: 2px;
}

View solution in original post

gljiva
Path Finder

Thanks, it works great! Only problem with this was that Paginator would also get positioned on the same line as the search fields. Solution is to add some html code to xml before Paginator module. This way Paginator will get positioned to a new line and be left aligned.

    <module name="StaticContentSample">
        <param name="text">&lt;br&gt;&lt;br&gt;&lt;br&gt;</param>
    </module>

    <module name="Paginator">
    ....
0 Karma

hazekamp
Builder

gljiva,

You need to do this using CSS. Each view can specify it's own custom CSS file using the following syntax:

<view template="dashboard.html" stylesheet="access_center.css">

The CSS file should live in $SPLUNK_HOME/etc/apps/$your_app$/appserver/static/

Each module in the view get's an ID. This is easily retrieved using firebug. In the case of getting those to span horizontally, you will want something like this:

#ExtendedFieldSearch_0_8_0 {
    float: left;
    padding-top: 2px;
}
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...