Splunk Search

Add SearchBar and Flashimeline using Simple XML in Splunk 6

Nicholas_Key
Splunk Employee
Splunk Employee

How do I add the SearchBar and FlashTimeline into my dashboard?

Given this simple XML

<dashboard>
  <label>Dummy dashboard</label>
</dashboard>

In Splunk 5.x, with Advanced XML, this is achievable with

<module name="SearchBar" layoutPanel="mainSearchControls">

What are the elements I need to add between dashboard element to display the following in Splunk 6?

screenshot

masonmorales
Influencer

You can achieve a similar result in Splunk 6.x using Advanced XML and "view" tags instead of "dashboard"

Here's an example:

<view>
  <label>Testing</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="SearchBar" layoutPanel="splSearchControls-inline">
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <param name="useOwnSubmitButton">False</param>
    <module name="TimeRangePicker">
      <param name="selected">Last 24 Hours</param>
      <param name="searchWhenChanged">True</param>        
        <module name="HiddenIntention">
          <param name="intention">
            <param name="name">addterm</param>
            <param name="arg">
             <param name="sourcetype">*</param>
            <param name="host">*</param> -->
                 </param>
          </param>

      <module name="SubmitButton">
        <param name="allowSoftSubmit">True</param>
        <module name="Message" layoutPanel="graphArea">
          <param name="filter">splunk.search.job</param>
          <param name="clearOnJobDispatch">True</param>
          <param name="maxSize">2</param>
          <module name="JobStatus">
            <param name="resultsLink">
              <param name="popup">True</param>
              <param name="viewTarget">report_builder_define_data</param>
              <param name="transformedResultsViewTarget">report_builder_format_report</param>
            </param>
            <module name="FlashTimeline" layoutPanel="graphArea">
              <param name="height">180px</param>
              <param name="width">100%</param>
              <module name="TitleBar" layoutPanel="viewHeader"/>
              <module name="FieldPicker" layoutPanel="sidebar">
                <param name="fields">host sourcetype source</param>
                <param name="link">
                  <param name="view">report_builder_format_report</param>
                </param>              
                <module name="Message" layoutPanel="resultsAreaLeft">
                  <param name="filter">pageControls</param>
                  <param name="clearOnJobDispatch">True</param>
                  <param name="maxSize">1</param>
                </module>
                <module name="Count" layoutPanel="pageControls">
                        <module name="Export">
        <param name="exportType">result</param>
    </module>
                  <param name="options">
                    <list>
                      <param name="text">10</param>
                      <param name="value">10</param>
                    </list>
                    <list>
                      <param name="text">20</param>
                      <param name="value">20</param>
                    </list>
                    <list>
                      <param name="text">50</param>
                       <param name="selected">true</param>
                      <param name="value">50</param>
                    </list>
                  </param>
                  <module name="ButtonSwitcher" layoutPanel="pageControls">
                    <param name="mode">independent</param>
                    <param name="selected">splIcon-events-list</param>
                    <param name="disableOnNull">True</param>
                    <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-list" altTitle="Events List">
                      <param name="entityLabel">events</param>
                      <param name="entityName">events</param>
                      <module name="Paginator" layoutPanel="pageControls">
                        <param name="entityName">events</param>
                        <param name="maxPages">15</param>                        
                        <module name="SoftWrap" layoutPanel="resultsOptions">
                          <param name="enable">True</param>
                          <module name="RowNumbers">
                            <module name="MaxLines">
                              <param name="options">
                                <list>
                                  <param name="text">5</param>
                                  <param name="selected">True</param>
                                  <param name="value">5</param>
                                </list>
                                <list>
                                  <param name="text">10</param>
                                  <param name="value">10</param>
                                </list>
                                <list>
                                  <param name="text">20</param>
                                  <param name="value">20</param>
                                </list>
                                <list>
                                  <param name="text">50</param>
                                  <param name="value">50</param>
                                </list>
                                <list>
                                  <param name="text">100</param>
                                  <param name="value">100</param>
                                </list>
                                <list>
                                  <param name="text">200</param>
                                  <param name="value">200</param>
                                </list>
                                <list>
                                  <param name="text">All</param>
                                  <param name="value">0</param>
                                </list>
                              </param>

                              <module name="Segmentation" >
                                <param name="options">
                                  <list>
                                    <param name="text">inner</param>
                                    <param name="selected">True</param>
                                    <param name="value">inner</param>
                                  </list>
                                  <list>
                                    <param name="text">outer</param>
                                    <param name="value">outer</param>
                                  </list>
                                  <list>
                                    <param name="text">full</param>
                                    <param name="value">full</param>
                                  </list>
                                  <list>
                                    <param name="text">raw</param>
                                    <param name="value">raw</param>
                                  </list>
                                </param>
                                <module name="EventsViewer" layoutPanel="resultsAreaLeft">
                                  <param name="segmentation">full</param>
                                  <param name="reportFieldLink">report_builder_format_report</param>
                                </module>
                              </module>
                            </module>
                          </module>
                        </module>
                      </module>
                    </module>
                    <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-table" altTitle="Events Table">
                      <param name="entityLabel">events</param>
                      <param name="entityName">events</param>
                      <module name="Paginator" layoutPanel="pageControls">
                        <param name="count">50</param>
                        <param name="entityName">events</param> 
                        <param name="maxPages">10</param>
                        <module name="RowNumbers" layoutPanel="resultsOptions">
                          <module name="DataOverlay" layoutPanel="resultsAreaLeft">
                            <module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
                              <param name="entityName">events</param>
                            </module>
                          </module>
                        </module>
                      </module>
                    </module>
                    <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-results-table" altTitle="Results Table">
                      <param name="entityLabel">results</param>
                      <param name="entityName">results</param>
                      <module name="EnablePreview" group="show" layoutPanel="resultsOptions">
                        <param name="enable">True</param>
                        <module name="Paginator" layoutPanel="pageControls">
                          <param name="count">50</param>
                          <param name="entityName">results</param> 
                          <param name="maxPages">10</param>
                          <module name="RowNumbers" layoutPanel="resultsOptions">
                            <module name="DataOverlay" layoutPanel="resultsAreaLeft">
                              <module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
                                <param name="entityName">results</param>
                              </module>
                            </module>
                          </module>
                        </module>
                      </module>
                    </module>
                  </module>                
                </module>
                <module name="MultiFieldViewer">
                  <param name="link">
                    <param name="view">report_builder_format_report</param>
                  </param>
                </module>
                <module name="SuggestedFieldViewer">
                  <param name="minDistinctCount">1</param>
                  <param name="minFrequency">0.5</param>
                  <param name="maxFields">50</param>
                  <param name="exclude">
                    <list>^date_.*</list>
                  </param>
                  <param name="link">
                    <param name="view">report_builder_format_report</param>
                  </param>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
  </module>
</view>
0 Karma

masonmorales
Influencer

FYI - I don't believe it's possible to add a SearchBar using SimpleXML in 6.x. See: http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/PanelreferenceforSimplifiedXML

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...