Getting Data In

How can I add a UI element in a dashboard to select the source?

czervos
Explorer

I have created some dashboard that I use to expedite debugging of certain issues with one of our applications. The issue I am having and I'd like to improve upon is that currently the source files are hardcoded into the searches of the dashboards. I know I can do a global search and replace in the XML to get it to look at other source files but this is not very user friendly if I want to share this dashboard/tool with others. Is there a way to add a UI element to do this much like the time - drop down in dashboards & apps?

I tried to do this manually and managed to create the UI element. However I can't get the source = $newsource to be replaced in the multiple searches that create the views of the dashboard.

TIA

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi czervos,

in addition to @somesoni2 answer, take a look at this nice example from the docs. If you follow this, you should be able to get it working.

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi czervos,

in addition to @somesoni2 answer, take a look at this nice example from the docs. If you follow this, you should be able to get it working.

cheers, MuS

0 Karma

somesoni2
Revered Legend

You can create a dropdown to hold the source data (use |metadata type=sources index=main | table source) and then use the dropdown token in your search.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...