how to dynamically generate a dashboard in which the # of panels is equal to the # of hosts

[myli12]

And in each panel, performs the same search for a host after a user enters the search phrase. for example, search "host = A Err*" in panel 1 and search "host = B Err*" in panel 2 after the user enters "Err*". Assume that we have maximum 10 hosts.

[sideview]

The only way in which this can be done with the core splunk UI is to use an event_renderer, but it's very tricky and full of pitfalls.

here's as simple example as I can give, and it will just render a couple fields wrapped in <p> tags. However you could use CSS to give them a floated layout instead. Note that this example is borrowed from my CDR/CMR app (not yet released)

Step 1: in event_renderers.conf

[simple_field_display]
eventtype = simple_field_display
priority = 1
template = simple_field_display.html

Step 2:

<%inherit file="//results/EventsViewer_default_renderer.html" />
<%def name="event_layout(job, event, request, options, xslt)">
    <%
    def getFieldValue(event, name):
        if event.fields.has_key(name) :
            for i, f in enumerate(event.fields[name]):
                return f
    field1  = getFieldValue(event, "some_interesting_field_name")
    field2  = getFieldValue(event, "some_other_interesting_field_name")
    %>
    <p>${field1|h},  ${field2|h}</p>
</%def>

Step 3:

In your XML, in whatever search is being used to render the events in the EventsViewer module, tack this onto the end of it

| eval eventtype="simple_field_display"

Step 4: restart splunk.

onto the end of the search. As long as you're using EventsViewer in the normal 'events' mode, this should work.

In other news I have an amazing prototype module that I'm working on called "Multiplexer" but it's a very tricky thing to get right. I do kind of need the module for some of my apps so I'll probably get it working and polished and documented soon as a part of sideview_utils.