Hi,
i'm currently trying to "optimize" a dashboard by reusing a base search for different panels.
This is the dashboard I want to "optimize":
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
<label>DriverDownloadDOS</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Yesterday abnormal activities" autoRun="True">
<param name="earliest">-1d@d</param>
<param name="latest">@d</param>
<param name="search">|savedsearch "Calculate downloads to file ratio by ip"|where ratio < 0.005 AND cnt_downloads > 500|sort +ratio</param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="SimpleResultsTable">
<param name="count">25</param>
</module>
</module>
</module>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col2" group="Map View" autoRun="True">
<param name="search">|savedsearch "Calculate downloads to file ratio by ip"|where ratio < 0.005 AND cnt_downloads>500|geonormalize|eval _geo_count=cnt_downloads|fields _geo_count,_lat,_lng</param>
<param name="groupLabel">Map View</param>
<param name="earliest">-1d@d</param>
<param name="latest">@d</param>
<module name="GoogleMaps">
<param name="scrollwheel">off</param>
<param name="autoPostProcess">false</param>
<param name="height">400px</param>
<param name="zoomLevel">2</param>
<param name="scaleControl">on</param>
<param name="mapType">hybrid</param>
<param name="mapTypeControl">off</param>
<param name="navigationControl">off</param>
</module>
</module>
</view>
This result in the correct map: http://www.freeimagehosting.net/uploads/2d01dd83f5.jpg
Here I want the same Output but reusing the base search:
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
<label>DriverDownloadDOS</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
<param name="earliest">-1d@d</param>
<param name="latest">@d</param>
<module name="HiddenSavedSearch" autoRun="True">
<param name="savedSearch">Calculate downloads to file ratio by ip</param>
<module name="HiddenPostProcess" layoutPanel="panel_row1_col1" group="Yesterday abnormal activities" autoRun="True">
<param name="search">where ratio < 0.005 AND cnt_downloads > 500|sort +ratio</param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="SimpleResultsTable">
<param name="count">25</param>
</module>
</module>
</module>
</module>
<module name="HiddenPostProcess" layoutPanel="panel_row1_col2" group="Map View" autoRun="True">
<param name="search">where ratio < 0.005 AND cnt_downloads>500|geonormalize|eval _geo_count=cnt_downloads|fields _geo_count,_lat,_lng</param>
<param name="groupLabel">Map View</param>
<module name="GoogleMaps">
<param name="scrollwheel">off</param>
<param name="autoPostProcess">false</param>
<param name="height">400px</param>
<param name="zoomLevel">2</param>
<param name="scaleControl">on</param>
<param name="mapType">hybrid</param>
<param name="mapTypeControl">off</param>
<param name="navigationControl">off</param>
</module>
</module>
</module>
</module>
</view>
This result in this map visualisation: http://www.freeimagehosting.net/uploads/f543fc852e.jpg
I've no idea whats wrong. Is there a syntax failure or something like that in my dashboard?
I'm an absolute newbie with the advanced dashboards. Until now I only used the simple XML-Style dashboards
... View more