Splunk Search

Add SearchBar and Flashimeline using Simple XML in Splunk 6

Nicholas_Key
Splunk Employee
Splunk Employee

How do I add the SearchBar and FlashTimeline into my dashboard?

Given this simple XML

<dashboard>
  <label>Dummy dashboard</label>
</dashboard>

In Splunk 5.x, with Advanced XML, this is achievable with

<module name="SearchBar" layoutPanel="mainSearchControls">

What are the elements I need to add between dashboard element to display the following in Splunk 6?

screenshot

masonmorales
Influencer

You can achieve a similar result in Splunk 6.x using Advanced XML and "view" tags instead of "dashboard"

Here's an example:

<view>
  <label>Testing</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="SearchBar" layoutPanel="splSearchControls-inline">
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <param name="useOwnSubmitButton">False</param>
    <module name="TimeRangePicker">
      <param name="selected">Last 24 Hours</param>
      <param name="searchWhenChanged">True</param>        
        <module name="HiddenIntention">
          <param name="intention">
            <param name="name">addterm</param>
            <param name="arg">
             <param name="sourcetype">*</param>
            <param name="host">*</param> -->
                 </param>
          </param>

      <module name="SubmitButton">
        <param name="allowSoftSubmit">True</param>
        <module name="Message" layoutPanel="graphArea">
          <param name="filter">splunk.search.job</param>
          <param name="clearOnJobDispatch">True</param>
          <param name="maxSize">2</param>
          <module name="JobStatus">
            <param name="resultsLink">
              <param name="popup">True</param>
              <param name="viewTarget">report_builder_define_data</param>
              <param name="transformedResultsViewTarget">report_builder_format_report</param>
            </param>
            <module name="FlashTimeline" layoutPanel="graphArea">
              <param name="height">180px</param>
              <param name="width">100%</param>
              <module name="TitleBar" layoutPanel="viewHeader"/>
              <module name="FieldPicker" layoutPanel="sidebar">
                <param name="fields">host sourcetype source</param>
                <param name="link">
                  <param name="view">report_builder_format_report</param>
                </param>              
                <module name="Message" layoutPanel="resultsAreaLeft">
                  <param name="filter">pageControls</param>
                  <param name="clearOnJobDispatch">True</param>
                  <param name="maxSize">1</param>
                </module>
                <module name="Count" layoutPanel="pageControls">
                        <module name="Export">
        <param name="exportType">result</param>
    </module>
                  <param name="options">
                    <list>
                      <param name="text">10</param>
                      <param name="value">10</param>
                    </list>
                    <list>
                      <param name="text">20</param>
                      <param name="value">20</param>
                    </list>
                    <list>
                      <param name="text">50</param>
                       <param name="selected">true</param>
                      <param name="value">50</param>
                    </list>
                  </param>
                  <module name="ButtonSwitcher" layoutPanel="pageControls">
                    <param name="mode">independent</param>
                    <param name="selected">splIcon-events-list</param>
                    <param name="disableOnNull">True</param>
                    <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-list" altTitle="Events List">
                      <param name="entityLabel">events</param>
                      <param name="entityName">events</param>
                      <module name="Paginator" layoutPanel="pageControls">
                        <param name="entityName">events</param>
                        <param name="maxPages">15</param>                        
                        <module name="SoftWrap" layoutPanel="resultsOptions">
                          <param name="enable">True</param>
                          <module name="RowNumbers">
                            <module name="MaxLines">
                              <param name="options">
                                <list>
                                  <param name="text">5</param>
                                  <param name="selected">True</param>
                                  <param name="value">5</param>
                                </list>
                                <list>
                                  <param name="text">10</param>
                                  <param name="value">10</param>
                                </list>
                                <list>
                                  <param name="text">20</param>
                                  <param name="value">20</param>
                                </list>
                                <list>
                                  <param name="text">50</param>
                                  <param name="value">50</param>
                                </list>
                                <list>
                                  <param name="text">100</param>
                                  <param name="value">100</param>
                                </list>
                                <list>
                                  <param name="text">200</param>
                                  <param name="value">200</param>
                                </list>
                                <list>
                                  <param name="text">All</param>
                                  <param name="value">0</param>
                                </list>
                              </param>

                              <module name="Segmentation" >
                                <param name="options">
                                  <list>
                                    <param name="text">inner</param>
                                    <param name="selected">True</param>
                                    <param name="value">inner</param>
                                  </list>
                                  <list>
                                    <param name="text">outer</param>
                                    <param name="value">outer</param>
                                  </list>
                                  <list>
                                    <param name="text">full</param>
                                    <param name="value">full</param>
                                  </list>
                                  <list>
                                    <param name="text">raw</param>
                                    <param name="value">raw</param>
                                  </list>
                                </param>
                                <module name="EventsViewer" layoutPanel="resultsAreaLeft">
                                  <param name="segmentation">full</param>
                                  <param name="reportFieldLink">report_builder_format_report</param>
                                </module>
                              </module>
                            </module>
                          </module>
                        </module>
                      </module>
                    </module>
                    <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-table" altTitle="Events Table">
                      <param name="entityLabel">events</param>
                      <param name="entityName">events</param>
                      <module name="Paginator" layoutPanel="pageControls">
                        <param name="count">50</param>
                        <param name="entityName">events</param> 
                        <param name="maxPages">10</param>
                        <module name="RowNumbers" layoutPanel="resultsOptions">
                          <module name="DataOverlay" layoutPanel="resultsAreaLeft">
                            <module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
                              <param name="entityName">events</param>
                            </module>
                          </module>
                        </module>
                      </module>
                    </module>
                    <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-results-table" altTitle="Results Table">
                      <param name="entityLabel">results</param>
                      <param name="entityName">results</param>
                      <module name="EnablePreview" group="show" layoutPanel="resultsOptions">
                        <param name="enable">True</param>
                        <module name="Paginator" layoutPanel="pageControls">
                          <param name="count">50</param>
                          <param name="entityName">results</param> 
                          <param name="maxPages">10</param>
                          <module name="RowNumbers" layoutPanel="resultsOptions">
                            <module name="DataOverlay" layoutPanel="resultsAreaLeft">
                              <module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
                                <param name="entityName">results</param>
                              </module>
                            </module>
                          </module>
                        </module>
                      </module>
                    </module>
                  </module>                
                </module>
                <module name="MultiFieldViewer">
                  <param name="link">
                    <param name="view">report_builder_format_report</param>
                  </param>
                </module>
                <module name="SuggestedFieldViewer">
                  <param name="minDistinctCount">1</param>
                  <param name="minFrequency">0.5</param>
                  <param name="maxFields">50</param>
                  <param name="exclude">
                    <list>^date_.*</list>
                  </param>
                  <param name="link">
                    <param name="view">report_builder_format_report</param>
                  </param>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
  </module>
</view>
0 Karma

masonmorales
Influencer

FYI - I don't believe it's possible to add a SearchBar using SimpleXML in 6.x. See: http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/PanelreferenceforSimplifiedXML

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...