Dashboards & Visualizations

What is the difference between display view in a search?

royimad
Builder

Hello Splunk Expert,

I came accross several searches that i have already developed with 4 options:
1-None
2-Flashtimeline
3-report_builder_display
4-charting
5- etc...

I have used the first 3 values and didn't find any problems in my searches, neither on my dashboards?
My question is when i should use Display View and How to customize new one on Splunk interface and link this view to the search?

Any answer would help.

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

If you put this attribute into a view tag, then when the end-user saves any searches or reports inside this view, those saved searches and reports will be associated with that different view.

ie when a user later loads that saved search or report, it will load in the "displayView" view instead of the view where it was saved.

Specifically, the stanza created in savedsearches.conf will get
displayView = some_view

Extra Detail:

If you're using the Sideview Utils "save_create_patches.js" file in your custom view and if users are saving reports in it, then the searches and reports will also get the key

request.ui_edit_view = view_where_it_was_created

When you are setting displayView as some other stripped down view, this will tell the savedsearch the location of the view where it was created, and where it can can thus be edited.

This can facilitate an overall design where not only do the reports load in some stripped down "displayView", but the stripped down view has a link that can take the user back to the "edit view". Since sideview style form prepopulation will work into any view, and since Sideview Adds the request.ui_context key to the savedsearch, this end-to-end design can be made to work and I've done it on a couple apps.

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

If you put this attribute into a view tag, then when the end-user saves any searches or reports inside this view, those saved searches and reports will be associated with that different view.

ie when a user later loads that saved search or report, it will load in the "displayView" view instead of the view where it was saved.

Specifically, the stanza created in savedsearches.conf will get
displayView = some_view

Extra Detail:

If you're using the Sideview Utils "save_create_patches.js" file in your custom view and if users are saving reports in it, then the searches and reports will also get the key

request.ui_edit_view = view_where_it_was_created

When you are setting displayView as some other stripped down view, this will tell the savedsearch the location of the view where it was created, and where it can can thus be edited.

This can facilitate an overall design where not only do the reports load in some stripped down "displayView", but the stripped down view has a link that can take the user back to the "edit view". Since sideview style form prepopulation will work into any view, and since Sideview Adds the request.ui_context key to the savedsearch, this end-to-end design can be made to work and I've done it on a couple apps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...