What is the difference between display view in a search?

[royimad]

Hello Splunk Expert,

I came accross several searches that i have already developed with 4 options:
1-None
2-Flashtimeline
3-report_builder_display
4-charting
5- etc...

I have used the first 3 values and didn't find any problems in my searches, neither on my dashboards?
My question is when i should use Display View and How to customize new one on Splunk interface and link this view to the search?

Any answer would help.

[sideview · Accepted solution]

If you put this attribute into a view tag, then when the end-user saves any searches or reports inside this view, those saved searches and reports will be associated with that different view.

ie when a user later loads that saved search or report, it will load in the "displayView" view instead of the view where it was saved.

Specifically, the stanza created in savedsearches.conf will get
displayView = some_view

Extra Detail:

If you're using the Sideview Utils "save_create_patches.js" file in your custom view and if users are saving reports in it, then the searches and reports will also get the key

request.ui_edit_view = view_where_it_was_created

When you are setting displayView as some other stripped down view, this will tell the savedsearch the location of the view where it was created, and where it can can thus be edited.

This can facilitate an overall design where not only do the reports load in some stripped down "displayView", but the stripped down view has a link that can take the user back to the "edit view". Since sideview style form prepopulation will work into any view, and since Sideview Adds the request.ui_context key to the savedsearch, this end-to-end design can be made to work and I've done it on a couple apps.