Dashboards & Visualizations

Having two form searches and result tables on same page....possible?

riderofyamaha
Explorer

I have a question on how to put multiple form searches on the same page that both feed a separate table. The first search is used in finding a specific I.P. address and what user is connected to it, pool ip, time etc. The second search below this has an Input field to put the username you just found in and see what recent activity they’ve logged. So, two searches and tables on same page…the problem im having is both tables are showing the results for the first search, instead of being separate so i tryed this xml using two form commands but the xml is invalid when i try and make a view. If i but dashboard at the beginning and end it accepts it but its a blank dashboard.

PLEASE HELP....i have to get this done today

cheers guys

 <form>
 <label>patrick help</label>
 <searchTemplate>(host=cvpn00bay-inside.bay.cbeyond.net) 
 713228 $inputIP$ | fields _time, vpn_poolip, Username, </searchTemplate>
 <earliestTime>-24h</earliestTime>
 <latestTime>-0d</latestTime>
 <fieldset>
  <input token="inputIP" />
  </fieldset>
  <row>
    <table>
     <title>Users assigned to IP in last 24 hours</title>
     <option name="count">25</option>
   </table>
    </row>
   </form>

 <form>
 <searchTemplate> $inputUser$ </searchTemplate>
 <earliestTime>-24h</earliestTime>
 <latestTime>-0d</latestTime>
<fieldset>
   <input token="inputUser" />
</fieldset>
<row>
  <table>
    <title>Users activity in last 24 hours</title>
    <option name="count">25</option>
  </table>
</row>
 </form>
Tags (2)
0 Karma

aymericbrun
Explorer

If you find an answer to your question i'm especially interested in 🙂

0 Karma

Lowell
Super Champion

Have you checked to see if there are any examples of this in the UI Examples app? (You cah download it here: http://www.splunkbase.com/apps/All/4.x/Add-On/app:UI+Examples)

0 Karma

Lowell
Super Champion

I'm thinking that you will have to use the advanced XML for this. (If you've never used the advanced XML before, it could take more than a day to get your head wrapped around it..., from my experience) Hopefully one of the UI experts will have better news for you

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...