Dashboards & Visualizations

Multiple search forms in a single line (advanced xml)?

gljiva
Path Finder

Hi, I don't know how to get multiple form search fields in a single line. I'd like to get it similar to simple xml form, where all form searches get added to single line one next to other. In advanced xml i use this code to add form searches to HiddenSearch module:

  <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Description" autoRun="True">
<param name="search">index=sth field="$to_replace$"</param>
<param name="groupLabel">Installation details</param>

<module name="TimeRangePicker">
    <param name="default">Last 7 days</param>
    <param name="searchWhenChanged">True</param>

<module name="ExtendedFieldSearch">
  <param name="field">Name</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
        <param name="to_replace">
            <param name="fillOnEmpty">True</param>
            <param name="value">*</param>
        </param>
    </param>
  </param>
  <param name="replacementMap">
    <param name="arg">
      <param name="to_replace">
          <param name="value">*</param>
      </param>
    </param>
  </param>

Problem is when I add multiple ExtendedFieldSearch modules, each gets put to a new line so it looks really bad and takes to much space. Is there some option to make them fit into single line?

0 Karma
1 Solution

hazekamp
Builder

gljiva,

You need to do this using CSS. Each view can specify it's own custom CSS file using the following syntax:

<view template="dashboard.html" stylesheet="access_center.css">

The CSS file should live in $SPLUNK_HOME/etc/apps/$your_app$/appserver/static/

Each module in the view get's an ID. This is easily retrieved using firebug. In the case of getting those to span horizontally, you will want something like this:

#ExtendedFieldSearch_0_8_0 {
    float: left;
    padding-top: 2px;
}

View solution in original post

gljiva
Path Finder

Thanks, it works great! Only problem with this was that Paginator would also get positioned on the same line as the search fields. Solution is to add some html code to xml before Paginator module. This way Paginator will get positioned to a new line and be left aligned.

    <module name="StaticContentSample">
        <param name="text">&lt;br&gt;&lt;br&gt;&lt;br&gt;</param>
    </module>

    <module name="Paginator">
    ....
0 Karma

hazekamp
Builder

gljiva,

You need to do this using CSS. Each view can specify it's own custom CSS file using the following syntax:

<view template="dashboard.html" stylesheet="access_center.css">

The CSS file should live in $SPLUNK_HOME/etc/apps/$your_app$/appserver/static/

Each module in the view get's an ID. This is easily retrieved using firebug. In the case of getting those to span horizontally, you will want something like this:

#ExtendedFieldSearch_0_8_0 {
    float: left;
    padding-top: 2px;
}
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...