Getting Data In

How can I add a UI element in a dashboard to select the source?

czervos
Explorer

I have created some dashboard that I use to expedite debugging of certain issues with one of our applications. The issue I am having and I'd like to improve upon is that currently the source files are hardcoded into the searches of the dashboards. I know I can do a global search and replace in the XML to get it to look at other source files but this is not very user friendly if I want to share this dashboard/tool with others. Is there a way to add a UI element to do this much like the time - drop down in dashboards & apps?

I tried to do this manually and managed to create the UI element. However I can't get the source = $newsource to be replaced in the multiple searches that create the views of the dashboard.

TIA

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi czervos,

in addition to @somesoni2 answer, take a look at this nice example from the docs. If you follow this, you should be able to get it working.

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi czervos,

in addition to @somesoni2 answer, take a look at this nice example from the docs. If you follow this, you should be able to get it working.

cheers, MuS

0 Karma

somesoni2
Revered Legend

You can create a dropdown to hold the source data (use |metadata type=sources index=main | table source) and then use the dropdown token in your search.

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...