Reporting

SavedSearches Call from Advanced XML

alenseb
Communicator

Hi guys,

What i am trying to do is to call a savedsearch from an advanced XML file for GoogleMaps
But due to some reason, the savedsearch doesn't get loaded. Am i missing something here?

Please help.

Thanks!!

<?xml version="1.0"?>





*
False
1


500px
off
splunk,roadmap,terrain,satellite
roadmap
true
clusters
m
0.75
0, 100, 500, 1000, 10000
true
<!-- changes by Alen Starts -->

| savedsearch Denial_GMap
-1y


False
row
results


<!-- changes by Alen Ends flashtimeline layoutPanel="panel_row1_col1" autoRun="True" -->

0 Karma
1 Solution

Ayn
Legend

Before debugging further, I think you should just use the HiddenSavedSearch module, instead of using HiddenSearch with the only purpose of running the savedsearch command. It's a bit backwards. 🙂

View solution in original post

0 Karma

alenseb
Communicator

Yep. I figured that. Thanks!
Here is the example:
YOUR SEARCH 700px true clientip satellite off 3 -11.867351, -167.695312

0 Karma

sideview
SplunkTrust
SplunkTrust

If it's your intention that the Google Map should load using the search results of the saved search, then your XML is backwards -- instead of nesting the HiddenSearch inside the GoogleMaps module you go the other way around.

0 Karma

alenseb
Communicator

advanced XML module you can use.

Example :


YOUR SEARCH

700px
true
clientip
satellite
off
3
-11.867351, -167.695312


0 Karma

Ayn
Legend

Before debugging further, I think you should just use the HiddenSavedSearch module, instead of using HiddenSearch with the only purpose of running the savedsearch command. It's a bit backwards. 🙂

0 Karma

Ayn
Legend

The concept of calling a saved search isn't any different just because the GoogleMaps module is involved somewhere. Module documentation is available on docs.splunk.com and in /modules on your Splunk server.

0 Karma

alenseb
Communicator

i tried UI Examples, but looks they don't have anything related to GoogleMaps.
Also looks like some of the Params like "-1y" doesn't work under module HiddenSavedSearch

0 Karma

Ayn
Legend

Umm, it depends. You can use all sorts of modules downstream from the HiddenSavedSearch module, but in that sense it is just as HiddenSearch.

If you haven't done it already, I advise you to download the UI examples app from splunkbase - it contains lots and lots of useful examples on how to do things like this.

0 Karma

alenseb
Communicator

Alright! Thanks!
What are the Child modules under HiddenSavedSearch?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...