Reporting

Saved searches not working via xml in view/dashboard

aportela
New Member

Have xml code used to generate view / dashboard, am trying to directly call "saved search" to produce output. Have tried to use the searchName and searchString tags, but neither of these work. However, xml code works when i use the actual search command string with the "param name=search" tag.

Are these tags not allowed in HTML panels? If not allowed, is there a command(s) that will permit directly calling "saved searches"? Or, do i need to re-write the view as another type of panel that is not HTML (e.g., table, etc.)?

Any and all help would be much appreciated.
Thanks... Al

Tags (1)
0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

You've asked if the searchName and searchString tags are valid in HTML panels. So I'm guessing you're doing something like this:


<dashboard>
<row>
<html>
<searchName>
...
</searchName>
</html>
</row>
</dashboard>

You can use searchName as a child of a <table>, <chart>,<event>, <single> or <list>.

See here for more info. I've written dashboards in Simple XML with both searchName referencing a named saved search, as well as searchString with the whole string.

View solution in original post

0 Karma

sowings
Splunk Employee
Splunk Employee

You've asked if the searchName and searchString tags are valid in HTML panels. So I'm guessing you're doing something like this:


<dashboard>
<row>
<html>
<searchName>
...
</searchName>
</html>
</row>
</dashboard>

You can use searchName as a child of a <table>, <chart>,<event>, <single> or <list>.

See here for more info. I've written dashboards in Simple XML with both searchName referencing a named saved search, as well as searchString with the whole string.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...