Hi all!
How can I declare few different SearchTemplate's in one Dashboard with SimpleXML? I need it for optimization. Or I can do it only with AdvancedXML?
In documentation (http://docs.splunk.com/Documentation/Splunk/6.1/Viz/PanelreferenceforSimplifiedXML) I found that
Thanks!
Currently (Splunk 6.1 and prior versions), Simple XML only supports a single global searchTemplate with then multiple searchPostProcess searches from that.
To support this, you can either use Advanced XML or HTML.
Splunk 6.2 now supports multiple background searches in Simple XML!
Check out the new syntax in the Splunk 6.x Dashboard Examples (https://apps.splunk.com/app/1603/).
The syntax looks something like this:
<search id="global_search">
<query>foo</query>
<earliest>-60h@h</earliest>
<latest>now</latest>
</search>
<search base="global_search">
<query>bar_1</query>
</search>
<search base="global_search">
<query>bar_2</query>
</search>
My work around right now while on 6.1 is to leverage scheduled saved search results by loading them using the | loadjob search command and then postprocessing down the result set. It beats running the same search over and over again.
| loadjob savedsearch="admin:search:MySavedSearch" | search host=hostA | timechart count
| loadjob savedsearch="admin:search:MySavedSearch" | search host=hostB | timechart count
Can anyone point me to some HTML examples of using more than one search that can be post processed in a single dashboard?
You can try this workaround, if it suits you. In this, I have replaced searchTemplate with hidden textbox and used its default value (the search your want to execute) in the search using tokens. Below is run anywhere sample.
<form>
<label>TestMultipleSearchTemplate</label>
<description/>
<fieldset submitButton="false" autoRun="true">
<input type="text" token="search1" id="field1">
<label>sourcetype</label>
<default>index=_internal source="*metrics.log" group=per_sourcetype_thruput</default>
</input>
<input type="text" token="search2" id="field2">
<label>sourcetype</label>
<default>index=_internal sourcetype=scheduler</default>
</input>
<html>
<style>.input#field1,.input#field2 { display:none; }</style>
</html>
</fieldset>
<row>
<chart>
<title>Search1 Chart</title>
<searchString>
$search1$ | timechart sum(kb) by series
</searchString>
<earliestTime>-1h@h</earliestTime>
<latestTime>now</latestTime>
<option name="height">200px</option>
<option name="charting.chart">line</option>
</chart>
<table>
<title>Search1 Table</title>
<searchString>
$search1$ | timechart sum(kb) by series
</searchString>
<earliestTime>-1h@h</earliestTime>
<latestTime>now</latestTime>
<option name="count">5</option>
</table>
</row>
<row>
<chart>
<title>Search2 Chart</title>
<searchString>
$search2$ | timechart count
</searchString>
<earliestTime>-1h@h</earliestTime>
<latestTime>now</latestTime>
<option name="height">200px</option>
<option name="charting.chart">line</option>
</chart>
<table>
<title>Search2 Table</title>
<searchString>
$search2$ | timechart count
</searchString>
<earliestTime>-1h@h</earliestTime>
<latestTime>now</latestTime>
<option name="count">5</option>
</table>
</row>
</form>
That is correct, you'll not be utilizing the performance benefit of the searchPostProcess here, but will be able to refactor code (not have to rewrite the same portion of the search multiple times). Any postProcess/Additional search will be appended after usage of token. ($tokenName$ | post process search)
Thanks! But as I understand, it's not PostProcess, it's just shared base search string?
Currently (Splunk 6.1 and prior versions), Simple XML only supports a single global searchTemplate with then multiple searchPostProcess searches from that.
To support this, you can either use Advanced XML or HTML.
Ok, thanks!
Unfortunately, AdvancedXML it's not acceptable for me, because TimePicker in AdvancedXML has not so handy style as in SimpleXML (http://answers.splunk.com/answers/139525/can-i-apply-default-style-for-timerangepicker-in-advancedxm...).