Dashboards & Visualizations

Unable to create dashboard

freephoneid
Path Finder

Hi,

I'm trying to create a splunk dashboard in splunk v4.2.2:

  1. When I click "Manager->UI->Views->New & I selected my app & pasted the below xml & still no dashboard!!!

    <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
    <label>My Dashboard</label>
    <module name="AccountBar" layoutPanel="appHeader"/>
    <module name="AppBar" layoutPanel="navigationHeader"/>
    <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
    </module>
    <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
    </module>
    <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
    </module>
    
    <module name="HiddenSearch" layoutPanel="panel_row3_col2" group="My first dash" autoRun="True">
    <module name="TimeRangePicker">
    <param name="searchWhenChanged">True</param>
    <param name="selected">Last 60 minutes</param>
    <module name="HiddenSearch" autoRun="True">
    <param name="search">MY_SAVED_SEARCH_QUERY</param>
     <module name="HiddenChartFormatter">
      <param name="chart">chart</param>
      <module name="FlashChart">
        <module name="ConvertToDrilldownSearch">
          <module name="ViewRedirector">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>
      </module>
     </module>
     </module>  
     </module>
     </view> 
    

Can any one tell me what I'm missing?? Why is it going into the View instead of Dashbaord menu?

I need to create the dashboard along with the dropdown menu of time but above xml seems to create the view. Can any one tell me how to create the dashboard with saved search & time dropdown menu?

Thanks!

Tags (1)
0 Karma

stephanefotso
Motivator
Hello! 
The first thing i would like to say is that a dashboard is a view, but a view is not a dashboard. Your code  is a view, since it is surrounded by  : `<view></view>`tags. Therefore it can't be found in  dashboards Menu. It is true you are Building a dashboard using advanced XML but it can't be found in dashboards Menu.

Secondly, when i look your code, i see four errors that you made:

    First Error :  layoutPanel="panel_row3_col2" is not good here, because the firs column is unoccupied . Instead, use  layoutPanel="panel_row3_col1" or layoutPanel="mainSearchControls" 

    Second Error :  `<module name="HiddenSearch" autoRun="True">` is not good here. Since you are running a saved seache you will use this:                         `<module name="HiddenSavedSearch" autoRun="True">`

   Third Error: `<param name="search">MY_SAVED_SEARCH_QUERY</param>` is not good. Since you are using a saved searche use this : `<param name="savedSearch">MY_SAVED_SEARCH_QUERY</param>`

   Fourth Error :   `<param name="chart">chart</param>` is not good. Expected values you can use for your chart parametters are: area,bar,column,line,pie, or scatter.

See below your modified code, using advanced XML firstly, and simple XML secondly. In that second case, you will see your dashboard in the dashboards Menu.This assume that you have a search called "My_save_search1" saved as a report

 <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
                    <label>My Dashboard</label>
                    <module name="AccountBar" layoutPanel="appHeader"/>
                    <module name="AppBar" layoutPanel="navigationHeader"/>
                    <module name="Message" layoutPanel="messaging">
                                    <param name="filter">*</param>
                                    <param name="clearOnJobDispatch">False</param>
                                    <param name="maxSize">1</param>
                    </module>
                    <module name="Message" layoutPanel="messaging">
                                    <param name="filter">splunk.search.job</param>
                                    <param name="clearOnJobDispatch">True</param>
                                    <param name="maxSize">1</param>
                    </module>
                    <module name="TitleBar" layoutPanel="viewHeader">
                                    <param name="actionsMenuFilter">dashboard</param>
                    </module>
                    <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="My first dash" autoRun="True">
                                    <module name="TimeRangePicker">
                                                    <param name="searchWhenChanged">True</param>
                                                    <param name="selected">Last 60 minutes</param>
                                                    <module name="HiddenSavedSearch" autoRun="True">
                                                                    <param name="savedSearch">My_save_search1</param>
                                                                    <module name="HiddenChartFormatter">
                                                                                    <param name="chart">bar</param>
                                                                                    <module name="FlashChart">
                                                                                                    <module name="ConvertToDrilldownSearch">
                                                                                                                    <module name="ViewRedirector">
                                                                                                                                    <param name="viewTarget">flashtimeline</param>
                                                                                                                    </module>
                                                                                                    </module>
                                                                                    </module>
                                                                    </module>
                                                    </module>
                                    </module>
                    </module>
    </view>

second code

 <form>
      <label> Chart panels powered by reports</label>
      <description>Top Sourcetypes by Time Period using Time Picker</description>
      <fieldset autoRun="true" submitButton="false">
        <input type="time" searchWhenChanged="true">
          <label>Select a time:</label>
          <default>Last 24 hours</default>
        </input>
      </fieldset>
      <row>
            <chart>

              <searchName>My_save_search1</searchName>
              <option name="charting.chart">column</option>
            </chart>

      </row>
    </form>
SGF
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...