Getting Data In

How can I add a UI element in a dashboard to select the source?

czervos
Explorer

I have created some dashboard that I use to expedite debugging of certain issues with one of our applications. The issue I am having and I'd like to improve upon is that currently the source files are hardcoded into the searches of the dashboards. I know I can do a global search and replace in the XML to get it to look at other source files but this is not very user friendly if I want to share this dashboard/tool with others. Is there a way to add a UI element to do this much like the time - drop down in dashboards & apps?

I tried to do this manually and managed to create the UI element. However I can't get the source = $newsource to be replaced in the multiple searches that create the views of the dashboard.

TIA

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi czervos,

in addition to @somesoni2 answer, take a look at this nice example from the docs. If you follow this, you should be able to get it working.

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi czervos,

in addition to @somesoni2 answer, take a look at this nice example from the docs. If you follow this, you should be able to get it working.

cheers, MuS

0 Karma

somesoni2
Revered Legend

You can create a dropdown to hold the source data (use |metadata type=sources index=main | table source) and then use the dropdown token in your search.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...