combine search bar and search results from other searches

[splunker30039]

I would like to create a dashboard that consists of 2 main parts:

1 - open search bar allowing any search 2 - results of searches that ran when dashboard was loaded, unrelated to 1).

I would like to be able to have both on one page.

so:

first part of page has the search bar that allows any search second part of page has the results of searches / pie charts etc - whatever you need. Those searches complete when you load the page, they are independent from the search bar.

[thall79]

I currently have dashboards setup with a search bar at the top and charts/tables under it.

 <module name="SearchBar" layoutPanel="mainSearchControls">
  <param name="label">true</param>   
   <param name="useAssistant">true</param>
   <param name="useTypeahead">true</param>
 <module name="TimeRangePicker">
  <module name="ViewRedirector">
   <param name="viewTarget">flashtimeline</param>
  </module><!-- /ViewRedirector -->
  </module><!-- /TimeRangePicker -->
  </module><!-- /SearchBar -->

Then after this you will just create your other modules that you want on the page.

Next question is where do you want your results to show after you run this search?

With the above setup it will redirect your current page to display the results. Not sure if you need the results to appear on that dashboard or open a new page. You will just need to play with the ViewRedirector part.

If you want it to open a page and leave the current alone just add:

     <param name="popup">True</param> 

After

    <param name="viewTarget">flashtimeline</param>

Hope this helps.

Travis.

[thall79]

Looks like you are using the Simple Dashboards and I am referencing Advanced Dashboards. Never tried to use the SearchBar module in a Simple Dashboard and I would recommend switching to an Adv. Dashboard since you can customize it more. Good starting point is http://www.splunk.com/base/Documentation/latest/Developer/AdvancedDashboard from there you should see other articles about Adv. Dashboards. Also splunkbase has example UI dashboards you can look at: http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+UI+examples+app+for+4.1%2B
Hope this helps. Travis.

[splunker30039]

sorry for the messed up format of my last comment. Hope its clear what I am trying to do.

[splunker30039]

so I got something like this:

Dashboard


awesomesearch1

[…]
search myawesomekeywords

anotherawesomsearch2




awesomesearch3
pie

[…]

And I want to insert a search bar on top of all the other searches.

Would that work?

[Brian_Osburn]

I don't have a way to test it right this second, but you should be able to set that up.

You will just need to make sure that the child modules are closed out correctly with the parent modules.

Brian