Hi! I have a very simple dashboard with URLLoader, Tabs, and the Switcher modules that is simply using lookups to display administrative csv files (ex. contact info etc) Problem 1. Lookups in a dashboard take a few seconds to load when tab is clicked. Is that normal? Splunk is actually running a search and it takes a few seconds after the tab is clicked to load the content in the lookup... I would think this should be almost instantaneous when the tab is clicked. I experimented with SavedSearch and HiddenSavedSearch modules but for some reason the saved searches are not being found when i change usehistory=true so I have to use "auto" until i figure out why the saved searches are not coming up. My guess is, my scheduled saved searches in this case aren't really "searches" per se, because it is simply |inputlookup and scheduled saved searches don't work with |inputlookup only? I'm not even sure the Scheduled Saved Search would be faster than an inline for a lookup but It was fun experimenting. Problem 2. I have 3 tabs. The tabs load the underlying lookups successfully every time they are clicked. At first when the tab is clicked it does the search thing. I go to another tab it searches and pulls up the lookup succesfully. However, I go back to the first tab, it has the content instantaneously since it was already loaded before (which is great) but then clears, reloads and would be annoying to a user. Now that i think about it: If i can load all lookups for all tabs with the dashboard initial load, and the tabs had everything loaded and ready to go, that would solve both problems 1 and 2. Any help would be greatly appreciated. The goal is to have instantaneous content when the tabs are clicked. Here's the code: <module name="URLLoader" layoutPanel="navigationHeader" autoRun="True"> <param name="keepURLUpdated">True</param> <module name="Tabs" layoutPanel="panel_row2_col1" autoRun="True"> <param name="name">selectedTab</param> <param name="staticTabs"> <list> <param name="label">test1</param> <param name="value">test1</param> </list> <list> <param name="label">test2</param> <param name="value">test2</param> </list> <list> <param name="label">test3</param> <param name="value">test3</param> </list> </param> <module name="Switcher" group=" "> <param name="selectedGroup">$selectedTab$</param> <module name="NullModule" group="test1"> <module name="HiddenSavedSearch" layoutPanel="panel_row3_col1" autoRun="True"> <param name="useHistory">auto</param> <param name="savedSearch">contacts</param> <module name="Table" layoutPanel="panel_row3_col1"> <param name="count">1000</param> </module> </module> </module> ... View more

Hello Friends! I have a dashboard with panels...I have a lookup with instructions on who to contact if x is seen the panel...I'd like to put an HTML module or something, that has + to expand the instructions below the panel so the users knows what to do, if they see x. The module can be in the same Row as the panel. I don't need post-processing, dynamics, or anything fancy. Just a simple dropdown with the inputlookup results. I would imagine an inline search with this '|inputlookup whotocontact.csv' on the module. Is there any way I can do the +(expand) -(collapse) with the whotocontact.csv contents? Is the HTML module what I should use? Here's the XML for one of my panels on the dashboard. <param name="useHistory">True</param> <param name="savedSearch">searchpanelx</param> <module name="HiddenChartFormatter"> <param name="charting.legend">legend</param> <param name="charting.legend.labelStyle.maximumWidth">400</param> <param name="charting.legend.labelStyle.minimumWidth">400</param> <module name="JobProgressIndicator"/> <param name="charting.chart.stackMode">stacked</param> <param name="charting.legend.placement">right</param> <param name="charting.chart">column</param> <param name="charting.fieldColors">{"Nothing":0x00FF00}</param> <module name="FlashChart"> <param name="height">230px</param> <module name="HiddenSearch" layoutPanel="panel_row5_col1" autoRun="True"> <param name="search"><![CDATA[`searchmacrox`]]></param> <param name="earliest">-2h</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirectorLink"> <param name="popup">True</param> <param name="viewTarget">flashtimeline</param> <param name="label">All Results</param> </module> </module> </module> </module> </module> </module> ... View more

I have a query that combines 1 search and 2 sub-searches. The main search is a summary index and sum(count) in the timechart to look right. The 2 sub searches do not need sum(count) - they just need "count" so they are represented properly on the timechart. I was thinking if there was a way to convert sum(count) to count I would be good. This summary index runs every 15 minutes and buckets by the minute: Here's my Attempt to translate sum(count) to count: index="summary_onemin" error | evenstats sum(count) as count by _time | append [| search index=power_user "null" | bucket _time span=2m | eval CODE=powerNULL] | timechart span=2m by CODE Without the subsearch the search would look like this and works as intended: index="summary_onemin" error | timechart sum(count) as COUNT by CODE ... View more

Are there any plans to get autorefresh module working with hiddenpostprocess module that is nested in a hiddensavedsearch module? Many larger dashboards run off of hiddensavedsearches and would benifet from "micro" panel updates. In a dashboard of 20 panels, it would be neat to have 4 different autorefresh modules that update the panels separately and prevent that sudden slowdown to a browser as the whole page reloads. Could the hiddenpostprocess have autorefresh? Is there a way to work-around it to get it to work? Perhaps with null modules? ... View more

I am experimenting with post process but post process seems to make the dashboard reload slower than the same dashboard that is using scheduled searches only. Is it safe to say with a dashboard with a high number of panels, I should use scheduled searches and avoid post process? Post process would seem more organized but between, post process or performance, i am going to have to go with performance. ... View more

Hi! I'm new to foo tokens and probably could use a little hand-holding! I have a dashboard with a auto-refresh check-box at the top and would like it to be unchecked automatically when Tab "test2" is selected which would ultimately disable the dashboard auto-refresh! Is this possible with $token$? <module name="HTML" ... name="autoRefreshCheckboxes" checked="$foo$"&gt; ... </module> ($foo$ = True|False) <module name="Tabs" layoutPanel="panel_row1_col1" autoRun="True"> <param name="name">selectedTab</param> <param name="name">foo</param> <param name="staticTabs"> <list> <param name="label">test1</param> <param name="value">test1</param> </list> <list> <param name="label">test2</param> <param name="value">test2</param> </list> </param> <list> <param name="value">True</param> </list> <list> <param name="value">False</param> </list> <module name="Switcher" group=" "> <param name="selectedGroup">$selectedTab$</param> <param name="selectedGroup">$foo$</param> <module name="NullModule" group="test1"> <module name="NullModule" group="True"> ...test1 tab content </module> </module> <module name="NullModule" group="test2"> <module name="NullModule" group="False"> ...test2 tab content </module> </module> ... View more

Hi! So i got my dashboard working with 2 tabs and i'm happy. However, when i select the second tab i don't want anything to happen until i click on the timeselector and then submit. I have autorun set to false on all the hidden searches below the timeselector. Anyone know how i can make the searches in the second tab not run all the searches until i hit the submit button? Right now everything runs when i hit the tab and i dno't want it to run until i hit the submit button. <module name="Tabs" layoutPanel="panel_row1_col1" autoRun="True"> <param name="name">selectedTab</param> <param name="staticTabs"> <list> <param name="label">test1</param> <param name="value">test1</param> </list> <list> <param name="label">test2</param> <param name="value">test2</param> </list> </param> <module name="Switcher" group=" "> <param name="selectedGroup">$selectedTab$</param> <module name="NullModule" group="test1"> ... hidden searches and stuff ... <module name="NullModule" group="test2"> <module name="TimeRangePicker" layoutPanel="panel_row2_col1_grp1" autoRun="False"> <param name="default">Last 15 minutes</param> <param name="searchWhenChanged">False</param> <module name="SubmitButton" layoutpanel="panel_row2_col1_grp2"> <param name="label">Submit</param> <param name="allowSoftSubmit">False</param> Also, i would like to not have the page autorefresh when test2(second tab) is selected but still autorefresh when tab1(first tab) is selected. ... View more

Hi! I have a dashboard with 20 rows and 1 column. I really like the legend on the right but the chart buckets don't line up when some of the fields have short values. If i put the legend on the bottom, the chart buckets line up but it doesn't look as good with the legend on the right. The only work around i can think of is make a macro with an eval statement that adds a bunch of spaces to the right of fields in the timechart so it puts spaces to the right of the value and pushes it over to the left so the chart buckets line up vertically. That's probably a ridiculous solution so I'd figured I'd ask here! ... View more