Hello,
I have a functioning dashboard which shows me various activities over a predefined time span.
This is not optimal as I have a chart for "activity over the last 3 days", "activity over the last week", etc. It would be much better to have for instance radio buttons above the chart which would set the time range.
I saw in the documentation that forms can do that. It looks to me, though, that they are separate from dashboards.
My question would then be: is it possible to modify a static dashboard to integrate to some panels dynamic, user settable data (like the radio buttons with the time range).
How would the <form>...</form>
data fit in that?
I tried to integrate a <form>
in the example below but I fail to get a chart (there are several panels in the actual dashboard so I am not sure how to nest <form>
, <chart>
and <row>
)
<?xml version='1.0' encoding='utf-8'?>
<dashboard>
<label>Virus</label>
<row>
<chart>
<searchString>eventtype="EVENT_OSCE_Virus" | dedup Virus, destination | timechart count by Virus</searchString>
<title>Virus last 7 days</title>
<earliestTime>-7d</earliestTime>
<latestTime>now</latestTime>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="drilldown">all</option>
</chart>
</row>
</dashboard>
I would like to suggest the usage of http://splunk-base.splunk.com/apps/36405/sideview-utils app. It would help you to easily create dynamic elements and it has great tutorials.
I would like to suggest the usage of http://splunk-base.splunk.com/apps/36405/sideview-utils app. It would help you to easily create dynamic elements and it has great tutorials.