Dashboards & Visualizations

Can you use a variable in a dashboard paramater?

vbumgarner
Contributor
<param name="savedSearch">Unique_Visitors_by_Server_Saved_$timeframe$</param>
Tags (1)

sideview
SplunkTrust
SplunkTrust

i'm not entirely sure what you're asking, but I can attempt an answer.

1) if you use the systems packaged in the sideview_utils app, I'd need more details about what you're trying to do specifically, but the answer is probably 'yes'. With the newer stuff there is a great deal more flexibility to substitute $foo$ args anywhere you like.

2) if you're using the default UI, the only way you can use a $foo$ argument like this is if you have pulldown or textfield module, and that is where the $timeframe$ value is going to be coming from, and you want to get that value into a search where some part of the search is living: Unique_Visitors_by_Server_Saved_$timeframe$. then it's possible. However we need more details.

In the meantime I would check out the "UI Examples for 4.1" app on splunkbase for an example of #2 and just in general if you havent looked through that app already.

and then once you've at least read through the introductory documentation in UI Examples, download sideview_utils. The sideview_utils app is a lot like ui_examples in spirit, but it talks about the custom modules it packages and how to use them.

0 Karma

vbumgarner
Contributor

I'm sorry, I didn't notice that it was printing the param tag literally to the browser, and therefore wasn't visible.

The goal here is to use saved search results for multiple timeframes on a single dashboard. Drawing the results needs to be fast.

The other options I've encountered are a switcher module, but then the XML is very bloated, or loadjob, but it errors out if the search happens to be running at that moment.

Is there a better option?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...