Dashboards & Visualizations

Nested search in form based dashboard panel

jangid
Builder

My XML for form based dashboard panel is

<form>
    <label>Job Statistics</label>   
    <fieldset autoRun="true">
        <input type="time" searchWhenChanged="true">
                    <default>Last 7 Days</default>
        </input>
        <input type="dropdown" token="JT_JOB_NAME">
            <label>Select Job Name</label>
            <populatingSearch fieldForValue="JT_JOB_NAME" fieldForLabel="JT_JOB_NAME">
                <![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB_NAME | dedup JT_JOB_NAME | sort JT_JOB_NAME ]]>
            </populatingSearch>
        </input>
        <input type="dropdown" token="JT_JOB_NAME">
            <label>Select Job ID</label>
            <populatingSearch fieldForValue="JT_JOB" fieldForLabel="JT_JOB">
                <![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB, JT_JOB_NAME | where JT_JOB_NAME="$JT_JOB_NAME$" | dedup JT_JOB | fields - JT_JOB_NAME | sort JT_JOB ]]>
            </populatingSearch>
        </input>
    </fieldset>
    <row>
        <chart>
            <searchTemplate>
            <![CDATA[ eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table _time JT_JOB, THROUGHPUT | where JT_JOB="$JT_JOB$" AND JT_JOB="$JT_JOB_NAME$" | timechart count(THROUGHPUT)]]>
            </searchTemplate>
            <label>Throughtput for $JT_JOB$ </label>
            <option name="charting.chart">line</option> 
            <option name="charting.primaryAxisTitle.text">Time</option>
            <option name="charting.secondaryAxisTitle.text">Throughput</option>         
        </chart>
    </row>
</form>

How Do I fill 2nd drop down based on first one?

Tags (1)
0 Karma
1 Solution

tfletcher_splun
Splunk Employee
Splunk Employee

You're going to need to convert to advanced xml most likely. I have done everything except the timerange picker:

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html">
    <label>Job Statistics</label>
    <module name="AccountBar" layoutPanel="appHeader"/>
    <module name="AppBar" layoutPanel="navigationHeader"/>
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>
    <module name="TitleBar" layoutPanel="viewHeader">
        <param name="actionsMenuFilter">dashboard</param>
    </module>
    <module name="SearchSelectLister" layoutPanel="mainSearchControls" group="appViewControls" autoRun="true">
        <param name="search"><![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB_NAME | dedup JT_JOB_NAME | sort JT_JOB_NAME ]]></param>
        <param name="label">Select Job Name</param>
        <param name="settingToCreate">JT_JOB_NAME_setting</param>
        <param name="searchFieldsToDisplay">
            <list>
                <param name="value">JT_JOB_NAME</param>
                <param name="label">JT_JOB_NAME</param>
            </list>
        </param>
        <param name="earliest">0</param>
        <module name="ConvertToIntention">
            <param name="settingToConvert">JT_JOB_NAME_setting</param>
            <param name="intention">
                <param name="name">stringreplace</param>
                <param name="arg">
                    <param name="app">
                        <param name="value">$target$</param>
                    </param>
                </param>
            </param>
            <module name="SearchSelectLister"  group="appViewControls">
                <param name="search"><![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB, JT_JOB_NAME | where JT_JOB_NAME="$JT_JOB_NAME$" | dedup JT_JOB | fields - JT_JOB_NAME | sort JT_JOB ]]></param>
                <param name="label">Select Job ID</param>
                <param name="settingToCreate">JT_JOB_setting</param>
                <param name="applyOuterIntentionsToInternalSearch">True</param>
                <param name="searchFieldsToDisplay">
                    <list>
                        <param name="value">JT_JOB</param>
                        <param name="label">JT_JOB</param>
                    </list>
                </param>
                <param name="earliest">0</param>
                <module name="ConvertToIntention">
                    <param name="settingToConvert">JT_JOB_setting</param>
                    <param name="intention">
                        <param name="name">stringreplace</param>
                        <param name="arg">
                            <param name="view">
                                <param name="value">$target$</param>
                            </param>
                        </param>
                    </param>
                    <module name="SubmitButton"  group="appViewControls">
                        <param name="label">Search</param>
                        <!-- Overall View Loadtime -->
                        <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Overall View Performance">
                            <param name="search"><![CDATA[ eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table _time JT_JOB, THROUGHPUT | where JT_JOB="$JT_JOB$" AND JT_JOB="$JT_JOB_NAME$" | timechart count(THROUGHPUT)]]></param>
                            <param name="earliest">0</param>
                            <module name="HiddenChartFormatter">
                                <param name="legend.placement">None</param>
                                <param name="secondaryAxisTitle.text">Throughput</param>
                                <param name="chart">line</param>
                                <param name="primaryAxisTitle.text">Time</param>
                                <module name="FlashChart">
                                    <param name="width">100%</param>
                                    <param name="height">250px</param>
                                </module>
                            </module>
                        </module>

                    </module>

                </module>
            </module>
        </module>

    </module>
</view>

You may find this link helpful:
http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/AdvancedDashboard

View solution in original post

tfletcher_splun
Splunk Employee
Splunk Employee

You're going to need to convert to advanced xml most likely. I have done everything except the timerange picker:

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html">
    <label>Job Statistics</label>
    <module name="AccountBar" layoutPanel="appHeader"/>
    <module name="AppBar" layoutPanel="navigationHeader"/>
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>
    <module name="TitleBar" layoutPanel="viewHeader">
        <param name="actionsMenuFilter">dashboard</param>
    </module>
    <module name="SearchSelectLister" layoutPanel="mainSearchControls" group="appViewControls" autoRun="true">
        <param name="search"><![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB_NAME | dedup JT_JOB_NAME | sort JT_JOB_NAME ]]></param>
        <param name="label">Select Job Name</param>
        <param name="settingToCreate">JT_JOB_NAME_setting</param>
        <param name="searchFieldsToDisplay">
            <list>
                <param name="value">JT_JOB_NAME</param>
                <param name="label">JT_JOB_NAME</param>
            </list>
        </param>
        <param name="earliest">0</param>
        <module name="ConvertToIntention">
            <param name="settingToConvert">JT_JOB_NAME_setting</param>
            <param name="intention">
                <param name="name">stringreplace</param>
                <param name="arg">
                    <param name="app">
                        <param name="value">$target$</param>
                    </param>
                </param>
            </param>
            <module name="SearchSelectLister"  group="appViewControls">
                <param name="search"><![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB, JT_JOB_NAME | where JT_JOB_NAME="$JT_JOB_NAME$" | dedup JT_JOB | fields - JT_JOB_NAME | sort JT_JOB ]]></param>
                <param name="label">Select Job ID</param>
                <param name="settingToCreate">JT_JOB_setting</param>
                <param name="applyOuterIntentionsToInternalSearch">True</param>
                <param name="searchFieldsToDisplay">
                    <list>
                        <param name="value">JT_JOB</param>
                        <param name="label">JT_JOB</param>
                    </list>
                </param>
                <param name="earliest">0</param>
                <module name="ConvertToIntention">
                    <param name="settingToConvert">JT_JOB_setting</param>
                    <param name="intention">
                        <param name="name">stringreplace</param>
                        <param name="arg">
                            <param name="view">
                                <param name="value">$target$</param>
                            </param>
                        </param>
                    </param>
                    <module name="SubmitButton"  group="appViewControls">
                        <param name="label">Search</param>
                        <!-- Overall View Loadtime -->
                        <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Overall View Performance">
                            <param name="search"><![CDATA[ eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table _time JT_JOB, THROUGHPUT | where JT_JOB="$JT_JOB$" AND JT_JOB="$JT_JOB_NAME$" | timechart count(THROUGHPUT)]]></param>
                            <param name="earliest">0</param>
                            <module name="HiddenChartFormatter">
                                <param name="legend.placement">None</param>
                                <param name="secondaryAxisTitle.text">Throughput</param>
                                <param name="chart">line</param>
                                <param name="primaryAxisTitle.text">Time</param>
                                <module name="FlashChart">
                                    <param name="width">100%</param>
                                    <param name="height">250px</param>
                                </module>
                            </module>
                        </module>

                    </module>

                </module>
            </module>
        </module>

    </module>
</view>

You may find this link helpful:
http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/AdvancedDashboard

Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...