Dashboards & Visualizations

Nested search in form based dashboard panel

jangid
Builder

My XML for form based dashboard panel is

<form>
    <label>Job Statistics</label>   
    <fieldset autoRun="true">
        <input type="time" searchWhenChanged="true">
                    <default>Last 7 Days</default>
        </input>
        <input type="dropdown" token="JT_JOB_NAME">
            <label>Select Job Name</label>
            <populatingSearch fieldForValue="JT_JOB_NAME" fieldForLabel="JT_JOB_NAME">
                <![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB_NAME | dedup JT_JOB_NAME | sort JT_JOB_NAME ]]>
            </populatingSearch>
        </input>
        <input type="dropdown" token="JT_JOB_NAME">
            <label>Select Job ID</label>
            <populatingSearch fieldForValue="JT_JOB" fieldForLabel="JT_JOB">
                <![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB, JT_JOB_NAME | where JT_JOB_NAME="$JT_JOB_NAME$" | dedup JT_JOB | fields - JT_JOB_NAME | sort JT_JOB ]]>
            </populatingSearch>
        </input>
    </fieldset>
    <row>
        <chart>
            <searchTemplate>
            <![CDATA[ eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table _time JT_JOB, THROUGHPUT | where JT_JOB="$JT_JOB$" AND JT_JOB="$JT_JOB_NAME$" | timechart count(THROUGHPUT)]]>
            </searchTemplate>
            <label>Throughtput for $JT_JOB$ </label>
            <option name="charting.chart">line</option> 
            <option name="charting.primaryAxisTitle.text">Time</option>
            <option name="charting.secondaryAxisTitle.text">Throughput</option>         
        </chart>
    </row>
</form>

How Do I fill 2nd drop down based on first one?

Tags (1)
0 Karma
1 Solution

tfletcher_splun
Splunk Employee
Splunk Employee

You're going to need to convert to advanced xml most likely. I have done everything except the timerange picker:

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html">
    <label>Job Statistics</label>
    <module name="AccountBar" layoutPanel="appHeader"/>
    <module name="AppBar" layoutPanel="navigationHeader"/>
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>
    <module name="TitleBar" layoutPanel="viewHeader">
        <param name="actionsMenuFilter">dashboard</param>
    </module>
    <module name="SearchSelectLister" layoutPanel="mainSearchControls" group="appViewControls" autoRun="true">
        <param name="search"><![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB_NAME | dedup JT_JOB_NAME | sort JT_JOB_NAME ]]></param>
        <param name="label">Select Job Name</param>
        <param name="settingToCreate">JT_JOB_NAME_setting</param>
        <param name="searchFieldsToDisplay">
            <list>
                <param name="value">JT_JOB_NAME</param>
                <param name="label">JT_JOB_NAME</param>
            </list>
        </param>
        <param name="earliest">0</param>
        <module name="ConvertToIntention">
            <param name="settingToConvert">JT_JOB_NAME_setting</param>
            <param name="intention">
                <param name="name">stringreplace</param>
                <param name="arg">
                    <param name="app">
                        <param name="value">$target$</param>
                    </param>
                </param>
            </param>
            <module name="SearchSelectLister"  group="appViewControls">
                <param name="search"><![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB, JT_JOB_NAME | where JT_JOB_NAME="$JT_JOB_NAME$" | dedup JT_JOB | fields - JT_JOB_NAME | sort JT_JOB ]]></param>
                <param name="label">Select Job ID</param>
                <param name="settingToCreate">JT_JOB_setting</param>
                <param name="applyOuterIntentionsToInternalSearch">True</param>
                <param name="searchFieldsToDisplay">
                    <list>
                        <param name="value">JT_JOB</param>
                        <param name="label">JT_JOB</param>
                    </list>
                </param>
                <param name="earliest">0</param>
                <module name="ConvertToIntention">
                    <param name="settingToConvert">JT_JOB_setting</param>
                    <param name="intention">
                        <param name="name">stringreplace</param>
                        <param name="arg">
                            <param name="view">
                                <param name="value">$target$</param>
                            </param>
                        </param>
                    </param>
                    <module name="SubmitButton"  group="appViewControls">
                        <param name="label">Search</param>
                        <!-- Overall View Loadtime -->
                        <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Overall View Performance">
                            <param name="search"><![CDATA[ eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table _time JT_JOB, THROUGHPUT | where JT_JOB="$JT_JOB$" AND JT_JOB="$JT_JOB_NAME$" | timechart count(THROUGHPUT)]]></param>
                            <param name="earliest">0</param>
                            <module name="HiddenChartFormatter">
                                <param name="legend.placement">None</param>
                                <param name="secondaryAxisTitle.text">Throughput</param>
                                <param name="chart">line</param>
                                <param name="primaryAxisTitle.text">Time</param>
                                <module name="FlashChart">
                                    <param name="width">100%</param>
                                    <param name="height">250px</param>
                                </module>
                            </module>
                        </module>

                    </module>

                </module>
            </module>
        </module>

    </module>
</view>

You may find this link helpful:
http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/AdvancedDashboard

View solution in original post

tfletcher_splun
Splunk Employee
Splunk Employee

You're going to need to convert to advanced xml most likely. I have done everything except the timerange picker:

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html">
    <label>Job Statistics</label>
    <module name="AccountBar" layoutPanel="appHeader"/>
    <module name="AppBar" layoutPanel="navigationHeader"/>
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>
    <module name="TitleBar" layoutPanel="viewHeader">
        <param name="actionsMenuFilter">dashboard</param>
    </module>
    <module name="SearchSelectLister" layoutPanel="mainSearchControls" group="appViewControls" autoRun="true">
        <param name="search"><![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB_NAME | dedup JT_JOB_NAME | sort JT_JOB_NAME ]]></param>
        <param name="label">Select Job Name</param>
        <param name="settingToCreate">JT_JOB_NAME_setting</param>
        <param name="searchFieldsToDisplay">
            <list>
                <param name="value">JT_JOB_NAME</param>
                <param name="label">JT_JOB_NAME</param>
            </list>
        </param>
        <param name="earliest">0</param>
        <module name="ConvertToIntention">
            <param name="settingToConvert">JT_JOB_NAME_setting</param>
            <param name="intention">
                <param name="name">stringreplace</param>
                <param name="arg">
                    <param name="app">
                        <param name="value">$target$</param>
                    </param>
                </param>
            </param>
            <module name="SearchSelectLister"  group="appViewControls">
                <param name="search"><![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB, JT_JOB_NAME | where JT_JOB_NAME="$JT_JOB_NAME$" | dedup JT_JOB | fields - JT_JOB_NAME | sort JT_JOB ]]></param>
                <param name="label">Select Job ID</param>
                <param name="settingToCreate">JT_JOB_setting</param>
                <param name="applyOuterIntentionsToInternalSearch">True</param>
                <param name="searchFieldsToDisplay">
                    <list>
                        <param name="value">JT_JOB</param>
                        <param name="label">JT_JOB</param>
                    </list>
                </param>
                <param name="earliest">0</param>
                <module name="ConvertToIntention">
                    <param name="settingToConvert">JT_JOB_setting</param>
                    <param name="intention">
                        <param name="name">stringreplace</param>
                        <param name="arg">
                            <param name="view">
                                <param name="value">$target$</param>
                            </param>
                        </param>
                    </param>
                    <module name="SubmitButton"  group="appViewControls">
                        <param name="label">Search</param>
                        <!-- Overall View Loadtime -->
                        <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Overall View Performance">
                            <param name="search"><![CDATA[ eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table _time JT_JOB, THROUGHPUT | where JT_JOB="$JT_JOB$" AND JT_JOB="$JT_JOB_NAME$" | timechart count(THROUGHPUT)]]></param>
                            <param name="earliest">0</param>
                            <module name="HiddenChartFormatter">
                                <param name="legend.placement">None</param>
                                <param name="secondaryAxisTitle.text">Throughput</param>
                                <param name="chart">line</param>
                                <param name="primaryAxisTitle.text">Time</param>
                                <module name="FlashChart">
                                    <param name="width">100%</param>
                                    <param name="height">250px</param>
                                </module>
                            </module>
                        </module>

                    </module>

                </module>
            </module>
        </module>

    </module>
</view>

You may find this link helpful:
http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/AdvancedDashboard

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...