- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Few SearchTemplate's in Dashboard for optimization...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all!
How can I declare few different SearchTemplate's in one Dashboard with SimpleXML? I need it for optimization. Or I can do it only with AdvancedXML?
In documentation (http://docs.splunk.com/Documentation/Splunk/6.1/Viz/PanelreferenceforSimplifiedXML) I found that
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Currently (Splunk 6.1 and prior versions), Simple XML only supports a single global searchTemplate with then multiple searchPostProcess searches from that.
To support this, you can either use Advanced XML or HTML.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk 6.2 now supports multiple background searches in Simple XML!
Check out the new syntax in the Splunk 6.x Dashboard Examples (https://apps.splunk.com/app/1603/).
The syntax looks something like this:
<search id="global_search">
<query>foo</query>
<earliest>-60h@h</earliest>
<latest>now</latest>
</search>
<search base="global_search">
<query>bar_1</query>
</search>
<search base="global_search">
<query>bar_2</query>
</search>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My work around right now while on 6.1 is to leverage scheduled saved search results by loading them using the | loadjob search command and then postprocessing down the result set. It beats running the same search over and over again.
| loadjob savedsearch="admin:search:MySavedSearch" | search host=hostA | timechart count
| loadjob savedsearch="admin:search:MySavedSearch" | search host=hostB | timechart count
Can anyone point me to some HTML examples of using more than one search that can be post processed in a single dashboard?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can try this workaround, if it suits you. In this, I have replaced searchTemplate with hidden textbox and used its default value (the search your want to execute) in the search using tokens. Below is run anywhere sample.
<form>
<label>TestMultipleSearchTemplate</label>
<description/>
<fieldset submitButton="false" autoRun="true">
<input type="text" token="search1" id="field1">
<label>sourcetype</label>
<default>index=_internal source="*metrics.log" group=per_sourcetype_thruput</default>
</input>
<input type="text" token="search2" id="field2">
<label>sourcetype</label>
<default>index=_internal sourcetype=scheduler</default>
</input>
<html>
<style>.input#field1,.input#field2 { display:none; }</style>
</html>
</fieldset>
<row>
<chart>
<title>Search1 Chart</title>
<searchString>
$search1$ | timechart sum(kb) by series
</searchString>
<earliestTime>-1h@h</earliestTime>
<latestTime>now</latestTime>
<option name="height">200px</option>
<option name="charting.chart">line</option>
</chart>
<table>
<title>Search1 Table</title>
<searchString>
$search1$ | timechart sum(kb) by series
</searchString>
<earliestTime>-1h@h</earliestTime>
<latestTime>now</latestTime>
<option name="count">5</option>
</table>
</row>
<row>
<chart>
<title>Search2 Chart</title>
<searchString>
$search2$ | timechart count
</searchString>
<earliestTime>-1h@h</earliestTime>
<latestTime>now</latestTime>
<option name="height">200px</option>
<option name="charting.chart">line</option>
</chart>
<table>
<title>Search2 Table</title>
<searchString>
$search2$ | timechart count
</searchString>
<earliestTime>-1h@h</earliestTime>
<latestTime>now</latestTime>
<option name="count">5</option>
</table>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That is correct, you'll not be utilizing the performance benefit of the searchPostProcess here, but will be able to refactor code (not have to rewrite the same portion of the search multiple times). Any postProcess/Additional search will be appended after usage of token. ($tokenName$ | post process search)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks! But as I understand, it's not PostProcess, it's just shared base search string?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Currently (Splunk 6.1 and prior versions), Simple XML only supports a single global searchTemplate with then multiple searchPostProcess searches from that.
To support this, you can either use Advanced XML or HTML.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok, thanks!
Unfortunately, AdvancedXML it's not acceptable for me, because TimePicker in AdvancedXML has not so handy style as in SimpleXML (http://answers.splunk.com/answers/139525/can-i-apply-default-style-for-timerangepicker-in-advancedxm...).
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
