Dashboards & Visualizations

Multiple search forms in a single line (advanced xml)?

gljiva
Path Finder

Hi, I don't know how to get multiple form search fields in a single line. I'd like to get it similar to simple xml form, where all form searches get added to single line one next to other. In advanced xml i use this code to add form searches to HiddenSearch module:

  <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Description" autoRun="True">
<param name="search">index=sth field="$to_replace$"</param>
<param name="groupLabel">Installation details</param>

<module name="TimeRangePicker">
    <param name="default">Last 7 days</param>
    <param name="searchWhenChanged">True</param>

<module name="ExtendedFieldSearch">
  <param name="field">Name</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
        <param name="to_replace">
            <param name="fillOnEmpty">True</param>
            <param name="value">*</param>
        </param>
    </param>
  </param>
  <param name="replacementMap">
    <param name="arg">
      <param name="to_replace">
          <param name="value">*</param>
      </param>
    </param>
  </param>

Problem is when I add multiple ExtendedFieldSearch modules, each gets put to a new line so it looks really bad and takes to much space. Is there some option to make them fit into single line?

0 Karma
1 Solution

hazekamp
Builder

gljiva,

You need to do this using CSS. Each view can specify it's own custom CSS file using the following syntax:

<view template="dashboard.html" stylesheet="access_center.css">

The CSS file should live in $SPLUNK_HOME/etc/apps/$your_app$/appserver/static/

Each module in the view get's an ID. This is easily retrieved using firebug. In the case of getting those to span horizontally, you will want something like this:

#ExtendedFieldSearch_0_8_0 {
    float: left;
    padding-top: 2px;
}

View solution in original post

gljiva
Path Finder

Thanks, it works great! Only problem with this was that Paginator would also get positioned on the same line as the search fields. Solution is to add some html code to xml before Paginator module. This way Paginator will get positioned to a new line and be left aligned.

    <module name="StaticContentSample">
        <param name="text">&lt;br&gt;&lt;br&gt;&lt;br&gt;</param>
    </module>

    <module name="Paginator">
    ....
0 Karma

hazekamp
Builder

gljiva,

You need to do this using CSS. Each view can specify it's own custom CSS file using the following syntax:

<view template="dashboard.html" stylesheet="access_center.css">

The CSS file should live in $SPLUNK_HOME/etc/apps/$your_app$/appserver/static/

Each module in the view get's an ID. This is easily retrieved using firebug. In the case of getting those to span horizontally, you will want something like this:

#ExtendedFieldSearch_0_8_0 {
    float: left;
    padding-top: 2px;
}
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...