Dashboards & Visualizations

Different text form inputs for each panel of a dashboard

HeinzWaescher
Motivator

Hi,

is it possible to create a dashboard and define different input elements for each panel? At the moment all panels in my dashboard react with the input elements at the top. I didn't find any information in docs how to achieve this.

BR

Heinz

0 Karma
1 Solution

wpreston
Motivator

Yes, this can be done easily in simple xml, but I believe only with Splunk 6.1 and above. There is an example in the Splunk 6 Dashboard Examples app, it's called "Form Elements Within Panels". Here is the example code from that app:

<form>
    <label>Form Elements Within Panels</label>
    <description>Example of placing form elements within a panel.</description>
    <row>
        <panel>
            <input type="dropdown" token="sourcetype1" searchWhenChanged="true">
                <label>Source types for _Internal All</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>splunkd</default>
            </input>
            <chart>
                <title>_Internal All</title>
                <searchString>index=_internal sourcetype="$sourcetype1$" | timechart count</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="charting.chart">line</option>
                <option name="charting.legend.placement">none</option>
            </chart>
        </panel>
        <panel>
            <input type="radio" token="sourcetype2" searchWhenChanged="true">
                <label>Source types for _Internal Top 3</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>*</default>
            </input>
            <event>
                <title>_Internal Top 3</title>
                <searchString>index=_internal sourcetype="$sourcetype2$" | head 3</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="maxLines">5</option>
                <option name="raw.drilldown">full</option>
                <option name="rowNumbers">0</option>
                <option name="type">list</option>
                <option name="count">5</option>
            </event>
        </panel>
    </row>
</form>

If you're on version of Splunk older than 6.1, I think you'll have to use advanced XML.

View solution in original post

wpreston
Motivator

Yes, this can be done easily in simple xml, but I believe only with Splunk 6.1 and above. There is an example in the Splunk 6 Dashboard Examples app, it's called "Form Elements Within Panels". Here is the example code from that app:

<form>
    <label>Form Elements Within Panels</label>
    <description>Example of placing form elements within a panel.</description>
    <row>
        <panel>
            <input type="dropdown" token="sourcetype1" searchWhenChanged="true">
                <label>Source types for _Internal All</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>splunkd</default>
            </input>
            <chart>
                <title>_Internal All</title>
                <searchString>index=_internal sourcetype="$sourcetype1$" | timechart count</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="charting.chart">line</option>
                <option name="charting.legend.placement">none</option>
            </chart>
        </panel>
        <panel>
            <input type="radio" token="sourcetype2" searchWhenChanged="true">
                <label>Source types for _Internal Top 3</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>*</default>
            </input>
            <event>
                <title>_Internal Top 3</title>
                <searchString>index=_internal sourcetype="$sourcetype2$" | head 3</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="maxLines">5</option>
                <option name="raw.drilldown">full</option>
                <option name="rowNumbers">0</option>
                <option name="type">list</option>
                <option name="count">5</option>
            </event>
        </panel>
    </row>
</form>

If you're on version of Splunk older than 6.1, I think you'll have to use advanced XML.

bwlm
Path Finder

This form example above no longer passes validation on Splunk 8.0.1 and maybe earlier, however one can copy the latest example from within the "Dashboard Examples App".

<form>
    <label>Form Elements Within Panels</label>
    <description>Dashboard Examples: Example of placing form elements within a panel.</description>
    <row>
        <panel>
            <input type="dropdown" token="sourcetype1" searchWhenChanged="true">
                <label>Source types for _Internal All</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>splunkd</default>
            </input>
            <chart>
                <title>_Internal All</title>
                <search>
                    <query>index=_internal sourcetype="$sourcetype1$" | timechart count</query>
                    <earliest>-4h@h</earliest>
                    <latest>now</latest>
                </search>
                <option name="charting.chart">line</option>
                <option name="charting.legend.placement">none</option>
            </chart>
        </panel>
        <panel>
            <input type="radio" token="sourcetype2" searchWhenChanged="true">
                <label>Source types for _Internal Top 3</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>*</default>
            </input>
            <event>
                <title>_Internal Top 3</title>
                <search>
                    <query>index=_internal sourcetype="$sourcetype2$" | head 3</query>
                    <earliest>-4h@h</earliest>
                    <latest>now</latest>
                </search>
                <option name="maxLines">5</option>
                <option name="raw.drilldown">full</option>
                <option name="rowNumbers">0</option>
                <option name="type">list</option>
                <option name="count">5</option>
            </event>
        </panel>
    </row>
</form>

0 Karma

HeinzWaescher
Motivator

Great, I'm on version 6.1 and it works fine! Thanks a lot.

Is it also possible to create a submit button for every panel? I tried to move the

<fieldset submitButton="true"> ...

to the panel level, but this caused an error.

bhgupta
Engager

whoa I didn't know panels could have input options; exactly the answer I was looking for. Thanks!

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...