Can I create a custom form and put in a flash timeline? Can I add the flashtimeline to existing panels on existing dashboards?

[wwhitener]

Can we add the flashtimeline to custom forms?

I'm putting together some forms to help our splunk installation. However, there is a request to display the flash timelines. Right now I'm doing the simple XML--I'm just starting with form development. Can we add the flash timeline to those forms?

Can we add the flashtimeline to existing panels on existing dashboards?

When we upgraded to 4.2.2, a bunch of our queries that were already feeding panels on dashboards went from flashtimeline to data tables. Can we add the flashtimelines back? Or turn them on?

[lguinn2 · Accepted solution]

Yes, you can, but you have to used advanced XML. Simple XML won't do it.

You can convert simple XML to advanced XML, so you don't have to start from scratch. To convert, open your dashboard. Then add ?showsource=true to the end of the URL, like this

http://splunk:8000/en-US/app/search/my_view?showsource=1

Scroll down and you will see a text window of XML. Copy all. Go back to Splunk Manager>>UI>>Views. Create a new view and paste the advanced XML into it. Voila! You now have advanced XML.

The module you want is called FlashTimeline. You wil need to add it to the various panels. In the Developer Manual, look at the Module Reference. FlashTimeline is in the Results category. The capitalization is important - don't confuse this with flashtimeline (all lower-case); that's something different.

This may take some experimenting, and it may not be simple. But you can always ask more questions!
Introduction to Advanced Views

[wwhitener]

Marking this as answered. It's slow, but I'm finally able to get an advanced dashboard up and running. I still have questions--for other Answers entries--but it's up on its feet now.

[wwhitener]

I'm still stuck. I'm looking at the UI Examples and not getting very far.

To be honest--what I'm after the FlashTimeline. In 3.4.5, when the dashboard was set up originally, it had the timeline there and there was a list of very nicely visual charts, rather than the stacks and stacks of records or charts. When we went to 4.2.2, the only chart was a bar chart or similar, and we lost the timeline.

Any ideas that you have would be great. When I open my view that I created with Simplified XML to get to the Advanced XML and paste it into a view, I get errors about the search command.

[wwhitener]

OK. I've read through the Introduction a few times, but I still have questions.

I have a clone of a Simple Dashboard and want to convert it. I went and added the showsource=1 (or true) and looked at the XML. How do I get the edited XML saved and put back into Splunk?