Splunk Search

Add SearchBar and Flashimeline using Simple XML in Splunk 6

Nicholas_Key
Splunk Employee
Splunk Employee

How do I add the SearchBar and FlashTimeline into my dashboard?

Given this simple XML

<dashboard>
  <label>Dummy dashboard</label>
</dashboard>

In Splunk 5.x, with Advanced XML, this is achievable with

<module name="SearchBar" layoutPanel="mainSearchControls">

What are the elements I need to add between dashboard element to display the following in Splunk 6?

screenshot

masonmorales
Influencer

You can achieve a similar result in Splunk 6.x using Advanced XML and "view" tags instead of "dashboard"

Here's an example:

<view>
  <label>Testing</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="SearchBar" layoutPanel="splSearchControls-inline">
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <param name="useOwnSubmitButton">False</param>
    <module name="TimeRangePicker">
      <param name="selected">Last 24 Hours</param>
      <param name="searchWhenChanged">True</param>        
        <module name="HiddenIntention">
          <param name="intention">
            <param name="name">addterm</param>
            <param name="arg">
             <param name="sourcetype">*</param>
            <param name="host">*</param> -->
                 </param>
          </param>

      <module name="SubmitButton">
        <param name="allowSoftSubmit">True</param>
        <module name="Message" layoutPanel="graphArea">
          <param name="filter">splunk.search.job</param>
          <param name="clearOnJobDispatch">True</param>
          <param name="maxSize">2</param>
          <module name="JobStatus">
            <param name="resultsLink">
              <param name="popup">True</param>
              <param name="viewTarget">report_builder_define_data</param>
              <param name="transformedResultsViewTarget">report_builder_format_report</param>
            </param>
            <module name="FlashTimeline" layoutPanel="graphArea">
              <param name="height">180px</param>
              <param name="width">100%</param>
              <module name="TitleBar" layoutPanel="viewHeader"/>
              <module name="FieldPicker" layoutPanel="sidebar">
                <param name="fields">host sourcetype source</param>
                <param name="link">
                  <param name="view">report_builder_format_report</param>
                </param>              
                <module name="Message" layoutPanel="resultsAreaLeft">
                  <param name="filter">pageControls</param>
                  <param name="clearOnJobDispatch">True</param>
                  <param name="maxSize">1</param>
                </module>
                <module name="Count" layoutPanel="pageControls">
                        <module name="Export">
        <param name="exportType">result</param>
    </module>
                  <param name="options">
                    <list>
                      <param name="text">10</param>
                      <param name="value">10</param>
                    </list>
                    <list>
                      <param name="text">20</param>
                      <param name="value">20</param>
                    </list>
                    <list>
                      <param name="text">50</param>
                       <param name="selected">true</param>
                      <param name="value">50</param>
                    </list>
                  </param>
                  <module name="ButtonSwitcher" layoutPanel="pageControls">
                    <param name="mode">independent</param>
                    <param name="selected">splIcon-events-list</param>
                    <param name="disableOnNull">True</param>
                    <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-list" altTitle="Events List">
                      <param name="entityLabel">events</param>
                      <param name="entityName">events</param>
                      <module name="Paginator" layoutPanel="pageControls">
                        <param name="entityName">events</param>
                        <param name="maxPages">15</param>                        
                        <module name="SoftWrap" layoutPanel="resultsOptions">
                          <param name="enable">True</param>
                          <module name="RowNumbers">
                            <module name="MaxLines">
                              <param name="options">
                                <list>
                                  <param name="text">5</param>
                                  <param name="selected">True</param>
                                  <param name="value">5</param>
                                </list>
                                <list>
                                  <param name="text">10</param>
                                  <param name="value">10</param>
                                </list>
                                <list>
                                  <param name="text">20</param>
                                  <param name="value">20</param>
                                </list>
                                <list>
                                  <param name="text">50</param>
                                  <param name="value">50</param>
                                </list>
                                <list>
                                  <param name="text">100</param>
                                  <param name="value">100</param>
                                </list>
                                <list>
                                  <param name="text">200</param>
                                  <param name="value">200</param>
                                </list>
                                <list>
                                  <param name="text">All</param>
                                  <param name="value">0</param>
                                </list>
                              </param>

                              <module name="Segmentation" >
                                <param name="options">
                                  <list>
                                    <param name="text">inner</param>
                                    <param name="selected">True</param>
                                    <param name="value">inner</param>
                                  </list>
                                  <list>
                                    <param name="text">outer</param>
                                    <param name="value">outer</param>
                                  </list>
                                  <list>
                                    <param name="text">full</param>
                                    <param name="value">full</param>
                                  </list>
                                  <list>
                                    <param name="text">raw</param>
                                    <param name="value">raw</param>
                                  </list>
                                </param>
                                <module name="EventsViewer" layoutPanel="resultsAreaLeft">
                                  <param name="segmentation">full</param>
                                  <param name="reportFieldLink">report_builder_format_report</param>
                                </module>
                              </module>
                            </module>
                          </module>
                        </module>
                      </module>
                    </module>
                    <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-table" altTitle="Events Table">
                      <param name="entityLabel">events</param>
                      <param name="entityName">events</param>
                      <module name="Paginator" layoutPanel="pageControls">
                        <param name="count">50</param>
                        <param name="entityName">events</param> 
                        <param name="maxPages">10</param>
                        <module name="RowNumbers" layoutPanel="resultsOptions">
                          <module name="DataOverlay" layoutPanel="resultsAreaLeft">
                            <module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
                              <param name="entityName">events</param>
                            </module>
                          </module>
                        </module>
                      </module>
                    </module>
                    <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-results-table" altTitle="Results Table">
                      <param name="entityLabel">results</param>
                      <param name="entityName">results</param>
                      <module name="EnablePreview" group="show" layoutPanel="resultsOptions">
                        <param name="enable">True</param>
                        <module name="Paginator" layoutPanel="pageControls">
                          <param name="count">50</param>
                          <param name="entityName">results</param> 
                          <param name="maxPages">10</param>
                          <module name="RowNumbers" layoutPanel="resultsOptions">
                            <module name="DataOverlay" layoutPanel="resultsAreaLeft">
                              <module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
                                <param name="entityName">results</param>
                              </module>
                            </module>
                          </module>
                        </module>
                      </module>
                    </module>
                  </module>                
                </module>
                <module name="MultiFieldViewer">
                  <param name="link">
                    <param name="view">report_builder_format_report</param>
                  </param>
                </module>
                <module name="SuggestedFieldViewer">
                  <param name="minDistinctCount">1</param>
                  <param name="minFrequency">0.5</param>
                  <param name="maxFields">50</param>
                  <param name="exclude">
                    <list>^date_.*</list>
                  </param>
                  <param name="link">
                    <param name="view">report_builder_format_report</param>
                  </param>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
  </module>
</view>
0 Karma

masonmorales
Influencer

FYI - I don't believe it's possible to add a SearchBar using SimpleXML in 6.x. See: http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/PanelreferenceforSimplifiedXML

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...