Dashboards & Visualizations

Few SearchTemplate's in Dashboard for optimization?

Nikita_Danilov
Path Finder

Hi all!

How can I declare few different SearchTemplate's in one Dashboard with SimpleXML? I need it for optimization. Or I can do it only with AdvancedXML?

In documentation (http://docs.splunk.com/Documentation/Splunk/6.1/Viz/PanelreferenceforSimplifiedXML) I found that can be declared not only in Form, in Table/Chart/Events/... too. But, I need to declare in and use results in few Charts (maybe as PostProcess).

Thanks!

0 Karma
1 Solution

nfilippi_splunk
Splunk Employee
Splunk Employee

Currently (Splunk 6.1 and prior versions), Simple XML only supports a single global searchTemplate with then multiple searchPostProcess searches from that.

To support this, you can either use Advanced XML or HTML.

View solution in original post

nfilippi_splunk
Splunk Employee
Splunk Employee

Splunk 6.2 now supports multiple background searches in Simple XML!

Check out the new syntax in the Splunk 6.x Dashboard Examples (https://apps.splunk.com/app/1603/).

The syntax looks something like this:

<search id="global_search">
   <query>foo</query>
   <earliest>-60h@h</earliest>
   <latest>now</latest>
</search>

<search base="global_search">
   <query>bar_1</query>
</search>

<search base="global_search">
   <query>bar_2</query>
</search>
0 Karma

cramasta
Builder

My work around right now while on 6.1 is to leverage scheduled saved search results by loading them using the | loadjob search command and then postprocessing down the result set. It beats running the same search over and over again.

| loadjob savedsearch="admin:search:MySavedSearch" | search host=hostA | timechart count

| loadjob savedsearch="admin:search:MySavedSearch" | search host=hostB | timechart count

Can anyone point me to some HTML examples of using more than one search that can be post processed in a single dashboard?

0 Karma

somesoni2
Revered Legend

You can try this workaround, if it suits you. In this, I have replaced searchTemplate with hidden textbox and used its default value (the search your want to execute) in the search using tokens. Below is run anywhere sample.

<form>
  <label>TestMultipleSearchTemplate</label>
  <description/>
  <fieldset submitButton="false" autoRun="true">
    <input type="text" token="search1" id="field1">
      <label>sourcetype</label>
      <default>index=_internal source="*metrics.log" group=per_sourcetype_thruput</default>      
    </input>
    <input type="text" token="search2" id="field2">
      <label>sourcetype</label>
      <default>index=_internal sourcetype=scheduler</default>      
    </input>
    <html>
      <style>.input#field1,.input#field2 { display:none; }</style>
    </html>
  </fieldset>
  <row>
    <chart>
      <title>Search1 Chart</title>
      <searchString>
        $search1$ | timechart sum(kb) by series
      </searchString>
      <earliestTime>-1h@h</earliestTime>
      <latestTime>now</latestTime>
      <option name="height">200px</option>
      <option name="charting.chart">line</option>
    </chart>
    <table>
      <title>Search1 Table</title>
      <searchString>
        $search1$ | timechart sum(kb) by series
      </searchString>
      <earliestTime>-1h@h</earliestTime>
      <latestTime>now</latestTime>
      <option name="count">5</option>     
    </table>
  </row>
   <row>
    <chart>
      <title>Search2 Chart</title>
      <searchString>
        $search2$ | timechart count
      </searchString>
      <earliestTime>-1h@h</earliestTime>
      <latestTime>now</latestTime>
      <option name="height">200px</option>
      <option name="charting.chart">line</option>
    </chart>
    <table>
      <title>Search2 Table</title>
      <searchString>
        $search2$ | timechart count
      </searchString>
      <earliestTime>-1h@h</earliestTime>
      <latestTime>now</latestTime>
      <option name="count">5</option>     
    </table>
  </row>
</form>
0 Karma

somesoni2
Revered Legend

That is correct, you'll not be utilizing the performance benefit of the searchPostProcess here, but will be able to refactor code (not have to rewrite the same portion of the search multiple times). Any postProcess/Additional search will be appended after usage of token. ($tokenName$ | post process search)

0 Karma

Nikita_Danilov
Path Finder

Thanks! But as I understand, it's not PostProcess, it's just shared base search string?

0 Karma

nfilippi_splunk
Splunk Employee
Splunk Employee

Currently (Splunk 6.1 and prior versions), Simple XML only supports a single global searchTemplate with then multiple searchPostProcess searches from that.

To support this, you can either use Advanced XML or HTML.

Nikita_Danilov
Path Finder

Ok, thanks!
Unfortunately, AdvancedXML it's not acceptable for me, because TimePicker in AdvancedXML has not so handy style as in SimpleXML (http://answers.splunk.com/answers/139525/can-i-apply-default-style-for-timerangepicker-in-advancedxm...).

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...