I thought this would be an easy one. I have a simple XML dashboard that I'm converting to advanced XML because I need give the user the choice of timeframe. Simple XML can't handle this because I insist on using saved searches. There's too many events to run them in real time. So, I have a Pulldown module for the the time range drop down (This month, Last month, Two months ago, etc) and I have a SavedSearch module where I need the "name" to be parameterized. The obvious attempt failed:
My idea was to have a separate saved search for each month named like so: JobDistribution, JobDistribution_1MonthAgo, JobDistribution_2MonthAgo, etc. "view_month" is the name of the Pulldown where its values are "", "_1MonthAgo", etc. The substitution is not happening and Splunk tells me it can't find the saved search "JobDistribution$view_month$".
Can the name of the search be parameterized?
Splunk 5.0.14 & SideviewUtils 2.2.2
... View more