Dashboards & Visualizations

tokens in advanced xml?

Azrielb
New Member

Hi, I tried this week to look into simple\advanced xml in splunk.
simple xml is "simple" enough to understand but I can't get the hang of the advanced one through the tutorials.
for example a simple form to create a chart with a token and a "time input":

<form>
  <label>New form</label>
  <searchTemplate>
  source="mysource" eventD=$eventD$  
    | stats sum(concurrentUsers) as concurrentbb by _time | timechart span=10m max(concurrentbb)
  </searchTemplate>  
<fieldset>
<input type="text" token="eventD">
  <label>eventD</label>
  <default></default>
  <seed>""</seed>
  <suffix></suffix>
</input>
<input type="time" />
</fieldset>

<row>
   <chart>
      <title>ConcurrentUsers</title>
      <option name="charting.chart">column</option>
      <option name="charting.primaryAxisTitle.text">User</option>
      <option name="charting.secondaryAxisTitle.text">ConcurrentUsers</option>
      <option name="charting.legend.placement">none</option>
      </chart>
  </row>

</form>


*** now I want to put this form inside a dashboard.
I managed to build a chart in it but I want to enable my users to insert values into tokens just like in the forms.

<view template="dashboard.html">
  <label>My Dashboard</label>

  <!-- top nav chrome -->
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>

  <!-- Renders the search box -->
  <module name="SearchBar" layoutPanel="mainSearchControls">

    <!-- Renders the resulting events from your search -->
    <module name="EventsViewer"/>

  </module><!-- close SearchBar module -->


  <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Messages per minute last hour" autoRun="True">
    <param name="search">source="analyticsreport" eventDescription=$eventD$ 
    | stats sum(concurrentUsers) as concurrentbb by _time | timechart span=10m max(concurrentbb)
    </param>

???????????????????????????????????????????????????????

  <module name="ResultsHeader">
      <param name="entityName">scanned</param>
      <param name="entityLabel">Events</param>

      <module name="FlashChart">
        <param name="height">180px</param>
        <param name="width">100%</param>
      </module>

    </module>
  </module>
</view>
Tags (2)
0 Karma

Damien_Dallimor
Ultra Champion

I would recommend installing the UI Examples app , it has plenty of examples of various Advanced XML Views that you can reference to create the functionality you want

Similarly, the Sideview Utils app , also has many examples of using the custom Sideview UI modules.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...