Dashboards & Visualizations

tokens in advanced xml?

Azrielb
New Member

Hi, I tried this week to look into simple\advanced xml in splunk.
simple xml is "simple" enough to understand but I can't get the hang of the advanced one through the tutorials.
for example a simple form to create a chart with a token and a "time input":

<form>
  <label>New form</label>
  <searchTemplate>
  source="mysource" eventD=$eventD$  
    | stats sum(concurrentUsers) as concurrentbb by _time | timechart span=10m max(concurrentbb)
  </searchTemplate>  
<fieldset>
<input type="text" token="eventD">
  <label>eventD</label>
  <default></default>
  <seed>""</seed>
  <suffix></suffix>
</input>
<input type="time" />
</fieldset>

<row>
   <chart>
      <title>ConcurrentUsers</title>
      <option name="charting.chart">column</option>
      <option name="charting.primaryAxisTitle.text">User</option>
      <option name="charting.secondaryAxisTitle.text">ConcurrentUsers</option>
      <option name="charting.legend.placement">none</option>
      </chart>
  </row>

</form>


*** now I want to put this form inside a dashboard.
I managed to build a chart in it but I want to enable my users to insert values into tokens just like in the forms.

<view template="dashboard.html">
  <label>My Dashboard</label>

  <!-- top nav chrome -->
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>

  <!-- Renders the search box -->
  <module name="SearchBar" layoutPanel="mainSearchControls">

    <!-- Renders the resulting events from your search -->
    <module name="EventsViewer"/>

  </module><!-- close SearchBar module -->


  <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Messages per minute last hour" autoRun="True">
    <param name="search">source="analyticsreport" eventDescription=$eventD$ 
    | stats sum(concurrentUsers) as concurrentbb by _time | timechart span=10m max(concurrentbb)
    </param>

???????????????????????????????????????????????????????

  <module name="ResultsHeader">
      <param name="entityName">scanned</param>
      <param name="entityLabel">Events</param>

      <module name="FlashChart">
        <param name="height">180px</param>
        <param name="width">100%</param>
      </module>

    </module>
  </module>
</view>
Tags (2)
0 Karma

Damien_Dallimor
Ultra Champion

I would recommend installing the UI Examples app , it has plenty of examples of various Advanced XML Views that you can reference to create the functionality you want

Similarly, the Sideview Utils app , also has many examples of using the custom Sideview UI modules.

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...