Dashboards & Visualizations

Nested search in form based dashboard panel

jangid
Builder

My XML for form based dashboard panel is

<form>
    <label>Job Statistics</label>   
    <fieldset autoRun="true">
        <input type="time" searchWhenChanged="true">
                    <default>Last 7 Days</default>
        </input>
        <input type="dropdown" token="JT_JOB_NAME">
            <label>Select Job Name</label>
            <populatingSearch fieldForValue="JT_JOB_NAME" fieldForLabel="JT_JOB_NAME">
                <![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB_NAME | dedup JT_JOB_NAME | sort JT_JOB_NAME ]]>
            </populatingSearch>
        </input>
        <input type="dropdown" token="JT_JOB_NAME">
            <label>Select Job ID</label>
            <populatingSearch fieldForValue="JT_JOB" fieldForLabel="JT_JOB">
                <![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB, JT_JOB_NAME | where JT_JOB_NAME="$JT_JOB_NAME$" | dedup JT_JOB | fields - JT_JOB_NAME | sort JT_JOB ]]>
            </populatingSearch>
        </input>
    </fieldset>
    <row>
        <chart>
            <searchTemplate>
            <![CDATA[ eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table _time JT_JOB, THROUGHPUT | where JT_JOB="$JT_JOB$" AND JT_JOB="$JT_JOB_NAME$" | timechart count(THROUGHPUT)]]>
            </searchTemplate>
            <label>Throughtput for $JT_JOB$ </label>
            <option name="charting.chart">line</option> 
            <option name="charting.primaryAxisTitle.text">Time</option>
            <option name="charting.secondaryAxisTitle.text">Throughput</option>         
        </chart>
    </row>
</form>

How Do I fill 2nd drop down based on first one?

Tags (1)
0 Karma
1 Solution

tfletcher_splun
Splunk Employee
Splunk Employee

You're going to need to convert to advanced xml most likely. I have done everything except the timerange picker:

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html">
    <label>Job Statistics</label>
    <module name="AccountBar" layoutPanel="appHeader"/>
    <module name="AppBar" layoutPanel="navigationHeader"/>
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>
    <module name="TitleBar" layoutPanel="viewHeader">
        <param name="actionsMenuFilter">dashboard</param>
    </module>
    <module name="SearchSelectLister" layoutPanel="mainSearchControls" group="appViewControls" autoRun="true">
        <param name="search"><![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB_NAME | dedup JT_JOB_NAME | sort JT_JOB_NAME ]]></param>
        <param name="label">Select Job Name</param>
        <param name="settingToCreate">JT_JOB_NAME_setting</param>
        <param name="searchFieldsToDisplay">
            <list>
                <param name="value">JT_JOB_NAME</param>
                <param name="label">JT_JOB_NAME</param>
            </list>
        </param>
        <param name="earliest">0</param>
        <module name="ConvertToIntention">
            <param name="settingToConvert">JT_JOB_NAME_setting</param>
            <param name="intention">
                <param name="name">stringreplace</param>
                <param name="arg">
                    <param name="app">
                        <param name="value">$target$</param>
                    </param>
                </param>
            </param>
            <module name="SearchSelectLister"  group="appViewControls">
                <param name="search"><![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB, JT_JOB_NAME | where JT_JOB_NAME="$JT_JOB_NAME$" | dedup JT_JOB | fields - JT_JOB_NAME | sort JT_JOB ]]></param>
                <param name="label">Select Job ID</param>
                <param name="settingToCreate">JT_JOB_setting</param>
                <param name="applyOuterIntentionsToInternalSearch">True</param>
                <param name="searchFieldsToDisplay">
                    <list>
                        <param name="value">JT_JOB</param>
                        <param name="label">JT_JOB</param>
                    </list>
                </param>
                <param name="earliest">0</param>
                <module name="ConvertToIntention">
                    <param name="settingToConvert">JT_JOB_setting</param>
                    <param name="intention">
                        <param name="name">stringreplace</param>
                        <param name="arg">
                            <param name="view">
                                <param name="value">$target$</param>
                            </param>
                        </param>
                    </param>
                    <module name="SubmitButton"  group="appViewControls">
                        <param name="label">Search</param>
                        <!-- Overall View Loadtime -->
                        <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Overall View Performance">
                            <param name="search"><![CDATA[ eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table _time JT_JOB, THROUGHPUT | where JT_JOB="$JT_JOB$" AND JT_JOB="$JT_JOB_NAME$" | timechart count(THROUGHPUT)]]></param>
                            <param name="earliest">0</param>
                            <module name="HiddenChartFormatter">
                                <param name="legend.placement">None</param>
                                <param name="secondaryAxisTitle.text">Throughput</param>
                                <param name="chart">line</param>
                                <param name="primaryAxisTitle.text">Time</param>
                                <module name="FlashChart">
                                    <param name="width">100%</param>
                                    <param name="height">250px</param>
                                </module>
                            </module>
                        </module>

                    </module>

                </module>
            </module>
        </module>

    </module>
</view>

You may find this link helpful:
http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/AdvancedDashboard

View solution in original post

tfletcher_splun
Splunk Employee
Splunk Employee

You're going to need to convert to advanced xml most likely. I have done everything except the timerange picker:

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html">
    <label>Job Statistics</label>
    <module name="AccountBar" layoutPanel="appHeader"/>
    <module name="AppBar" layoutPanel="navigationHeader"/>
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>
    <module name="TitleBar" layoutPanel="viewHeader">
        <param name="actionsMenuFilter">dashboard</param>
    </module>
    <module name="SearchSelectLister" layoutPanel="mainSearchControls" group="appViewControls" autoRun="true">
        <param name="search"><![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB_NAME | dedup JT_JOB_NAME | sort JT_JOB_NAME ]]></param>
        <param name="label">Select Job Name</param>
        <param name="settingToCreate">JT_JOB_NAME_setting</param>
        <param name="searchFieldsToDisplay">
            <list>
                <param name="value">JT_JOB_NAME</param>
                <param name="label">JT_JOB_NAME</param>
            </list>
        </param>
        <param name="earliest">0</param>
        <module name="ConvertToIntention">
            <param name="settingToConvert">JT_JOB_NAME_setting</param>
            <param name="intention">
                <param name="name">stringreplace</param>
                <param name="arg">
                    <param name="app">
                        <param name="value">$target$</param>
                    </param>
                </param>
            </param>
            <module name="SearchSelectLister"  group="appViewControls">
                <param name="search"><![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB, JT_JOB_NAME | where JT_JOB_NAME="$JT_JOB_NAME$" | dedup JT_JOB | fields - JT_JOB_NAME | sort JT_JOB ]]></param>
                <param name="label">Select Job ID</param>
                <param name="settingToCreate">JT_JOB_setting</param>
                <param name="applyOuterIntentionsToInternalSearch">True</param>
                <param name="searchFieldsToDisplay">
                    <list>
                        <param name="value">JT_JOB</param>
                        <param name="label">JT_JOB</param>
                    </list>
                </param>
                <param name="earliest">0</param>
                <module name="ConvertToIntention">
                    <param name="settingToConvert">JT_JOB_setting</param>
                    <param name="intention">
                        <param name="name">stringreplace</param>
                        <param name="arg">
                            <param name="view">
                                <param name="value">$target$</param>
                            </param>
                        </param>
                    </param>
                    <module name="SubmitButton"  group="appViewControls">
                        <param name="label">Search</param>
                        <!-- Overall View Loadtime -->
                        <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Overall View Performance">
                            <param name="search"><![CDATA[ eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table _time JT_JOB, THROUGHPUT | where JT_JOB="$JT_JOB$" AND JT_JOB="$JT_JOB_NAME$" | timechart count(THROUGHPUT)]]></param>
                            <param name="earliest">0</param>
                            <module name="HiddenChartFormatter">
                                <param name="legend.placement">None</param>
                                <param name="secondaryAxisTitle.text">Throughput</param>
                                <param name="chart">line</param>
                                <param name="primaryAxisTitle.text">Time</param>
                                <module name="FlashChart">
                                    <param name="width">100%</param>
                                    <param name="height">250px</param>
                                </module>
                            </module>
                        </module>

                    </module>

                </module>
            </module>
        </module>

    </module>
</view>

You may find this link helpful:
http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/AdvancedDashboard

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...