Dashboards & Visualizations

tokens in advanced xml?

Azrielb
New Member

Hi, I tried this week to look into simple\advanced xml in splunk.
simple xml is "simple" enough to understand but I can't get the hang of the advanced one through the tutorials.
for example a simple form to create a chart with a token and a "time input":

<form>
  <label>New form</label>
  <searchTemplate>
  source="mysource" eventD=$eventD$  
    | stats sum(concurrentUsers) as concurrentbb by _time | timechart span=10m max(concurrentbb)
  </searchTemplate>  
<fieldset>
<input type="text" token="eventD">
  <label>eventD</label>
  <default></default>
  <seed>""</seed>
  <suffix></suffix>
</input>
<input type="time" />
</fieldset>

<row>
   <chart>
      <title>ConcurrentUsers</title>
      <option name="charting.chart">column</option>
      <option name="charting.primaryAxisTitle.text">User</option>
      <option name="charting.secondaryAxisTitle.text">ConcurrentUsers</option>
      <option name="charting.legend.placement">none</option>
      </chart>
  </row>

</form>


*** now I want to put this form inside a dashboard.
I managed to build a chart in it but I want to enable my users to insert values into tokens just like in the forms.

<view template="dashboard.html">
  <label>My Dashboard</label>

  <!-- top nav chrome -->
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>

  <!-- Renders the search box -->
  <module name="SearchBar" layoutPanel="mainSearchControls">

    <!-- Renders the resulting events from your search -->
    <module name="EventsViewer"/>

  </module><!-- close SearchBar module -->


  <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Messages per minute last hour" autoRun="True">
    <param name="search">source="analyticsreport" eventDescription=$eventD$ 
    | stats sum(concurrentUsers) as concurrentbb by _time | timechart span=10m max(concurrentbb)
    </param>

???????????????????????????????????????????????????????

  <module name="ResultsHeader">
      <param name="entityName">scanned</param>
      <param name="entityLabel">Events</param>

      <module name="FlashChart">
        <param name="height">180px</param>
        <param name="width">100%</param>
      </module>

    </module>
  </module>
</view>
Tags (2)
0 Karma

Damien_Dallimor
Ultra Champion

I would recommend installing the UI Examples app , it has plenty of examples of various Advanced XML Views that you can reference to create the functionality you want

Similarly, the Sideview Utils app , also has many examples of using the custom Sideview UI modules.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...