Dashboards & Visualizations

Different text form inputs for each panel of a dashboard

HeinzWaescher
Motivator

Hi,

is it possible to create a dashboard and define different input elements for each panel? At the moment all panels in my dashboard react with the input elements at the top. I didn't find any information in docs how to achieve this.

BR

Heinz

0 Karma
1 Solution

wpreston
Motivator

Yes, this can be done easily in simple xml, but I believe only with Splunk 6.1 and above. There is an example in the Splunk 6 Dashboard Examples app, it's called "Form Elements Within Panels". Here is the example code from that app:

<form>
    <label>Form Elements Within Panels</label>
    <description>Example of placing form elements within a panel.</description>
    <row>
        <panel>
            <input type="dropdown" token="sourcetype1" searchWhenChanged="true">
                <label>Source types for _Internal All</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>splunkd</default>
            </input>
            <chart>
                <title>_Internal All</title>
                <searchString>index=_internal sourcetype="$sourcetype1$" | timechart count</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="charting.chart">line</option>
                <option name="charting.legend.placement">none</option>
            </chart>
        </panel>
        <panel>
            <input type="radio" token="sourcetype2" searchWhenChanged="true">
                <label>Source types for _Internal Top 3</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>*</default>
            </input>
            <event>
                <title>_Internal Top 3</title>
                <searchString>index=_internal sourcetype="$sourcetype2$" | head 3</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="maxLines">5</option>
                <option name="raw.drilldown">full</option>
                <option name="rowNumbers">0</option>
                <option name="type">list</option>
                <option name="count">5</option>
            </event>
        </panel>
    </row>
</form>

If you're on version of Splunk older than 6.1, I think you'll have to use advanced XML.

View solution in original post

wpreston
Motivator

Yes, this can be done easily in simple xml, but I believe only with Splunk 6.1 and above. There is an example in the Splunk 6 Dashboard Examples app, it's called "Form Elements Within Panels". Here is the example code from that app:

<form>
    <label>Form Elements Within Panels</label>
    <description>Example of placing form elements within a panel.</description>
    <row>
        <panel>
            <input type="dropdown" token="sourcetype1" searchWhenChanged="true">
                <label>Source types for _Internal All</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>splunkd</default>
            </input>
            <chart>
                <title>_Internal All</title>
                <searchString>index=_internal sourcetype="$sourcetype1$" | timechart count</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="charting.chart">line</option>
                <option name="charting.legend.placement">none</option>
            </chart>
        </panel>
        <panel>
            <input type="radio" token="sourcetype2" searchWhenChanged="true">
                <label>Source types for _Internal Top 3</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>*</default>
            </input>
            <event>
                <title>_Internal Top 3</title>
                <searchString>index=_internal sourcetype="$sourcetype2$" | head 3</searchString>
                <earliestTime>-4h@h</earliestTime>
                <latestTime>now</latestTime>
                <option name="maxLines">5</option>
                <option name="raw.drilldown">full</option>
                <option name="rowNumbers">0</option>
                <option name="type">list</option>
                <option name="count">5</option>
            </event>
        </panel>
    </row>
</form>

If you're on version of Splunk older than 6.1, I think you'll have to use advanced XML.

bwlm
Path Finder

This form example above no longer passes validation on Splunk 8.0.1 and maybe earlier, however one can copy the latest example from within the "Dashboard Examples App".

<form>
    <label>Form Elements Within Panels</label>
    <description>Dashboard Examples: Example of placing form elements within a panel.</description>
    <row>
        <panel>
            <input type="dropdown" token="sourcetype1" searchWhenChanged="true">
                <label>Source types for _Internal All</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>splunkd</default>
            </input>
            <chart>
                <title>_Internal All</title>
                <search>
                    <query>index=_internal sourcetype="$sourcetype1$" | timechart count</query>
                    <earliest>-4h@h</earliest>
                    <latest>now</latest>
                </search>
                <option name="charting.chart">line</option>
                <option name="charting.legend.placement">none</option>
            </chart>
        </panel>
        <panel>
            <input type="radio" token="sourcetype2" searchWhenChanged="true">
                <label>Source types for _Internal Top 3</label>
                <choice value="*">All</choice>
                <choice value="splunkd">splunkd</choice>
                <choice value="splunk_web_access">splunk_web_access</choice>
                <default>*</default>
            </input>
            <event>
                <title>_Internal Top 3</title>
                <search>
                    <query>index=_internal sourcetype="$sourcetype2$" | head 3</query>
                    <earliest>-4h@h</earliest>
                    <latest>now</latest>
                </search>
                <option name="maxLines">5</option>
                <option name="raw.drilldown">full</option>
                <option name="rowNumbers">0</option>
                <option name="type">list</option>
                <option name="count">5</option>
            </event>
        </panel>
    </row>
</form>

0 Karma

HeinzWaescher
Motivator

Great, I'm on version 6.1 and it works fine! Thanks a lot.

Is it also possible to create a submit button for every panel? I tried to move the

<fieldset submitButton="true"> ...

to the panel level, but this caused an error.

bhgupta
Engager

whoa I didn't know panels could have input options; exactly the answer I was looking for. Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...