Hi all,
in Splunk 6 SimpleXML dashboards, there is support for a global search template (<searchTemplate />
) and postprocessing (<searchPostProcess />
) in panels later.
Is it somehow possible to postprocess the searchtemplate to populate a dropdown input?
Thanks,
Simon
Hi Simon,
I have some dashboards that populate a dropdown, it's like this:
<fieldset>
<input type="dropdown" token="dropdownlabel">
<label>Select:</label>
<populatingSearch fieldForValue="dropdownlabel" fieldForLabel="dropdownlabel">
<![CDATA[sourcetype="src" earliest=-7d | stats count by dropdownlabel]]>
</populatingSearch>
</input>
<input type="time">
<default>Last 7 days</default>
</input>
</fieldset>
You just needs to wait some seconds until the search return the list of dropdown and then select the content.
Hope this helps!
Anyone from Splunk able to comment on this? I would also like to postprocess the search template to populate my values in the dropdown menu.
did you ever find an answer to this?
I believe
And later of course
Hello,
Thanks I was aware of this option!
I rather was searching for a solution to only have one running search,e.g.
<row>
<chart>
<searchPostProcess>search sourcetype="$sourcetype$"| timechart count by sourcetype
...
</chart>
</row>
Hello,
Thanks I was aware of this option!
I rather was searching for a solution to only have one running search,e.g.
<form>
<searchTemplate>index=_internal</searchTemplate>
<fieldset>
<input type="dropdown" token="sourcetype=" fieldForValue="sourcetype" fieldForLabel="label">
<searchPostProcess>stats count by sourcetype | eval label=sourcetype." (".count.")"</searchPostProcess>
<choice value="*">All</choice>
<default>*</choice>
</input>
</fieldset>
</form>