Dashboards & Visualizations

Unable to create dashboard

freephoneid
Path Finder

Hi,

I'm trying to create a splunk dashboard in splunk v4.2.2:

  1. When I click "Manager->UI->Views->New & I selected my app & pasted the below xml & still no dashboard!!!

    <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
    <label>My Dashboard</label>
    <module name="AccountBar" layoutPanel="appHeader"/>
    <module name="AppBar" layoutPanel="navigationHeader"/>
    <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
    </module>
    <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
    </module>
    <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
    </module>
    
    <module name="HiddenSearch" layoutPanel="panel_row3_col2" group="My first dash" autoRun="True">
    <module name="TimeRangePicker">
    <param name="searchWhenChanged">True</param>
    <param name="selected">Last 60 minutes</param>
    <module name="HiddenSearch" autoRun="True">
    <param name="search">MY_SAVED_SEARCH_QUERY</param>
     <module name="HiddenChartFormatter">
      <param name="chart">chart</param>
      <module name="FlashChart">
        <module name="ConvertToDrilldownSearch">
          <module name="ViewRedirector">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>
      </module>
     </module>
     </module>  
     </module>
     </view> 
    

Can any one tell me what I'm missing?? Why is it going into the View instead of Dashbaord menu?

I need to create the dashboard along with the dropdown menu of time but above xml seems to create the view. Can any one tell me how to create the dashboard with saved search & time dropdown menu?

Thanks!

Tags (1)
0 Karma

stephanefotso
Motivator
Hello! 
The first thing i would like to say is that a dashboard is a view, but a view is not a dashboard. Your code  is a view, since it is surrounded by  : `<view></view>`tags. Therefore it can't be found in  dashboards Menu. It is true you are Building a dashboard using advanced XML but it can't be found in dashboards Menu.

Secondly, when i look your code, i see four errors that you made:

    First Error :  layoutPanel="panel_row3_col2" is not good here, because the firs column is unoccupied . Instead, use  layoutPanel="panel_row3_col1" or layoutPanel="mainSearchControls" 

    Second Error :  `<module name="HiddenSearch" autoRun="True">` is not good here. Since you are running a saved seache you will use this:                         `<module name="HiddenSavedSearch" autoRun="True">`

   Third Error: `<param name="search">MY_SAVED_SEARCH_QUERY</param>` is not good. Since you are using a saved searche use this : `<param name="savedSearch">MY_SAVED_SEARCH_QUERY</param>`

   Fourth Error :   `<param name="chart">chart</param>` is not good. Expected values you can use for your chart parametters are: area,bar,column,line,pie, or scatter.

See below your modified code, using advanced XML firstly, and simple XML secondly. In that second case, you will see your dashboard in the dashboards Menu.This assume that you have a search called "My_save_search1" saved as a report

 <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
                    <label>My Dashboard</label>
                    <module name="AccountBar" layoutPanel="appHeader"/>
                    <module name="AppBar" layoutPanel="navigationHeader"/>
                    <module name="Message" layoutPanel="messaging">
                                    <param name="filter">*</param>
                                    <param name="clearOnJobDispatch">False</param>
                                    <param name="maxSize">1</param>
                    </module>
                    <module name="Message" layoutPanel="messaging">
                                    <param name="filter">splunk.search.job</param>
                                    <param name="clearOnJobDispatch">True</param>
                                    <param name="maxSize">1</param>
                    </module>
                    <module name="TitleBar" layoutPanel="viewHeader">
                                    <param name="actionsMenuFilter">dashboard</param>
                    </module>
                    <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="My first dash" autoRun="True">
                                    <module name="TimeRangePicker">
                                                    <param name="searchWhenChanged">True</param>
                                                    <param name="selected">Last 60 minutes</param>
                                                    <module name="HiddenSavedSearch" autoRun="True">
                                                                    <param name="savedSearch">My_save_search1</param>
                                                                    <module name="HiddenChartFormatter">
                                                                                    <param name="chart">bar</param>
                                                                                    <module name="FlashChart">
                                                                                                    <module name="ConvertToDrilldownSearch">
                                                                                                                    <module name="ViewRedirector">
                                                                                                                                    <param name="viewTarget">flashtimeline</param>
                                                                                                                    </module>
                                                                                                    </module>
                                                                                    </module>
                                                                    </module>
                                                    </module>
                                    </module>
                    </module>
    </view>

second code

 <form>
      <label> Chart panels powered by reports</label>
      <description>Top Sourcetypes by Time Period using Time Picker</description>
      <fieldset autoRun="true" submitButton="false">
        <input type="time" searchWhenChanged="true">
          <label>Select a time:</label>
          <default>Last 24 hours</default>
        </input>
      </fieldset>
      <row>
            <chart>

              <searchName>My_save_search1</searchName>
              <option name="charting.chart">column</option>
            </chart>

      </row>
    </form>
SGF
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...