Dashboards & Visualizations

form : view results

LauraBre
Communicator

Hello,

I create a form with "single" but we can't see the results of the search button. How can do it to have a link "view result".

Thanks by advance for your answer.

This is a part of my xml file:

<form>

...

      <searchString>source=tcp:5555 PURCH_DAY=06-14 PURCH_DATE=19 PA_HOST="|tpwacs01v.priv.atos.fr" SD_STAT_PA="YES" | stats count | rangemap field=count severe=0-0 elevated=1-40 default=low</searchString>

      <title>Host: tpwacs01v.priv.atos.fr</title>

      <earliestTime>-7d</earliestTime>

      <option name="beforeLabel">PA YES : </option>

      <option name="classField">range</option>

      <option name="field">count</option>

    </single>

  </row>

...
</form>
Tags (1)
0 Karma

Drainy
Champion

Right, so I know how to do this via advanced XML so that is what my answer will be in, its quite easy once you get into it and generally most users end up having to jump into it sooner or later 🙂
As per;
http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/ModuleReference

You want;

linkFields
Specify whether to just link the result, or include labels. To link the result and both labels, specify "result,beforeLabel,afterLabel"
defaults to: result

linkSearch
Specify a valid complete search query to turn the result into a clickable link

To convert your existing dashboard to advanced XML just append ?showsource=1 to the end of the URL. As an example I have created a singleValue for you below in advanced XML;

Or at least I would if Splunkbase would let me paste it properly! I've put it here; http://pastebin.com/Q3GFK60z

The way you mention in your question, with a click to view results, can cause formatting issues with singleValues but if you really want you can do it with a ViewRedirectorLink module as per the module reference above, just reply if you're after that.

smolcj
Builder

is it possible to pass the same through linkview? like along with the viewname foreg flashtimeline?source=$form.sources$
something like that
please help

0 Karma

smolcj
Builder

How can we add a dropdown box variable to this link search?

0 Karma

LauraBre
Communicator

Thx very much for your answer. I create a view following yours links. I have a problem when I go on the link. The error is:Splunk cannot find the "dashboard" view.This page was linked to from http://odpc:8000/en-US/app/ACS/ACS_alertes.
This is my xml file :


result
source=tcp:5555 PCH_D=06-14 PCH_DT=19|stats count
range

0 Karma

Drainy
Champion

so lets say that your dashboard is called bobsthings. You would go to the URL http://SPLUNKSERVER:8000/en-GB/app/search/bobsthings?showsource=1 assuming you are using port 8000, not SSL and en-GB 🙂 (although that will work anyway, regardless)

0 Karma

LauraBre
Communicator

Thx for your answer. I don't understand very well how have I to do to convert my dashboard because I don't have url in my xml file.

<?xml version='1.0' encoding='utf-8'?>



UVB : Error Codes



...

my search
Host: tpw.fr
-7d
VE YES:
range
count


0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...