Dashboards & Visualizations

Unable to create dashboard

freephoneid
Path Finder

Hi,

I'm trying to create a splunk dashboard in splunk v4.2.2:

  1. When I click "Manager->UI->Views->New & I selected my app & pasted the below xml & still no dashboard!!!

    <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
    <label>My Dashboard</label>
    <module name="AccountBar" layoutPanel="appHeader"/>
    <module name="AppBar" layoutPanel="navigationHeader"/>
    <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
    </module>
    <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
    </module>
    <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
    </module>
    
    <module name="HiddenSearch" layoutPanel="panel_row3_col2" group="My first dash" autoRun="True">
    <module name="TimeRangePicker">
    <param name="searchWhenChanged">True</param>
    <param name="selected">Last 60 minutes</param>
    <module name="HiddenSearch" autoRun="True">
    <param name="search">MY_SAVED_SEARCH_QUERY</param>
     <module name="HiddenChartFormatter">
      <param name="chart">chart</param>
      <module name="FlashChart">
        <module name="ConvertToDrilldownSearch">
          <module name="ViewRedirector">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>
      </module>
     </module>
     </module>  
     </module>
     </view> 
    

Can any one tell me what I'm missing?? Why is it going into the View instead of Dashbaord menu?

I need to create the dashboard along with the dropdown menu of time but above xml seems to create the view. Can any one tell me how to create the dashboard with saved search & time dropdown menu?

Thanks!

Tags (1)
0 Karma

stephanefotso
Motivator
Hello! 
The first thing i would like to say is that a dashboard is a view, but a view is not a dashboard. Your code  is a view, since it is surrounded by  : `<view></view>`tags. Therefore it can't be found in  dashboards Menu. It is true you are Building a dashboard using advanced XML but it can't be found in dashboards Menu.

Secondly, when i look your code, i see four errors that you made:

    First Error :  layoutPanel="panel_row3_col2" is not good here, because the firs column is unoccupied . Instead, use  layoutPanel="panel_row3_col1" or layoutPanel="mainSearchControls" 

    Second Error :  `<module name="HiddenSearch" autoRun="True">` is not good here. Since you are running a saved seache you will use this:                         `<module name="HiddenSavedSearch" autoRun="True">`

   Third Error: `<param name="search">MY_SAVED_SEARCH_QUERY</param>` is not good. Since you are using a saved searche use this : `<param name="savedSearch">MY_SAVED_SEARCH_QUERY</param>`

   Fourth Error :   `<param name="chart">chart</param>` is not good. Expected values you can use for your chart parametters are: area,bar,column,line,pie, or scatter.

See below your modified code, using advanced XML firstly, and simple XML secondly. In that second case, you will see your dashboard in the dashboards Menu.This assume that you have a search called "My_save_search1" saved as a report

 <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
                    <label>My Dashboard</label>
                    <module name="AccountBar" layoutPanel="appHeader"/>
                    <module name="AppBar" layoutPanel="navigationHeader"/>
                    <module name="Message" layoutPanel="messaging">
                                    <param name="filter">*</param>
                                    <param name="clearOnJobDispatch">False</param>
                                    <param name="maxSize">1</param>
                    </module>
                    <module name="Message" layoutPanel="messaging">
                                    <param name="filter">splunk.search.job</param>
                                    <param name="clearOnJobDispatch">True</param>
                                    <param name="maxSize">1</param>
                    </module>
                    <module name="TitleBar" layoutPanel="viewHeader">
                                    <param name="actionsMenuFilter">dashboard</param>
                    </module>
                    <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="My first dash" autoRun="True">
                                    <module name="TimeRangePicker">
                                                    <param name="searchWhenChanged">True</param>
                                                    <param name="selected">Last 60 minutes</param>
                                                    <module name="HiddenSavedSearch" autoRun="True">
                                                                    <param name="savedSearch">My_save_search1</param>
                                                                    <module name="HiddenChartFormatter">
                                                                                    <param name="chart">bar</param>
                                                                                    <module name="FlashChart">
                                                                                                    <module name="ConvertToDrilldownSearch">
                                                                                                                    <module name="ViewRedirector">
                                                                                                                                    <param name="viewTarget">flashtimeline</param>
                                                                                                                    </module>
                                                                                                    </module>
                                                                                    </module>
                                                                    </module>
                                                    </module>
                                    </module>
                    </module>
    </view>

second code

 <form>
      <label> Chart panels powered by reports</label>
      <description>Top Sourcetypes by Time Period using Time Picker</description>
      <fieldset autoRun="true" submitButton="false">
        <input type="time" searchWhenChanged="true">
          <label>Select a time:</label>
          <default>Last 24 hours</default>
        </input>
      </fieldset>
      <row>
            <chart>

              <searchName>My_save_search1</searchName>
              <option name="charting.chart">column</option>
            </chart>

      </row>
    </form>
SGF
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...