Dash Board: Creating a Drop Down Menu with XML

[mmedal]

Hey Splunk Wizards,

I have a simple dash board that displays a graph and table of some storage information. The XML looks like this:

< ?xml version='1.0' encoding='utf-8'?>

< dashboard>

< label>NAS Usage< /label>

< row>

< chart>

< searchString>index=usagereport sourcetype="nasoverall"| timechart max(Total_Space) as "Total Space Allocated" max(Used_Space) as "Space Used"< /searchString>

< title>Total NAS Usage by Filer< /title>

< earliestTime>-14d< /earliestTime>

< latestTime>now< /latestTime>

< option name="charting.axisTitleX.text">Date< /option>

< option name="charting.axisTitleY.text">Space in TB< /option>

< option name="charting.axisY.maximumNumber">50< /option>

< option name="charting.axisY.minimumNumber">0< /option>

< option name="charting.chart">line< /option>

< option name="charting.primaryAxisTitle.text"/>

< option name="charting.secondaryAxisTitle.text"/>

< option name="count">10< /option>

< option name="displayRowNumbers">true< /option>

< option name="maxLines">10< /option>

< option name="segmentation">outer< /option>

< option name="softWrap">true< /option>

< /chart>

< /row>

< row>

< table>

< searchString>index=usagereport sourcetype=nasreport_log Filer_Name="*" | rename Aggr as "Aggregate", Volume_Total as "Total Allocated", Volume_Used as "Used Space" | table Volume "Total Allocated" "Used Space" "Aggregate" | sort +Aggregate< /searchString>

< title>Disk Usage< /title>

< earliestTime>@d< /earliestTime>

< latestTime>now< /latestTime>

< option name="count">50< /option>

< option name="displayRowNumbers">false< /option>

< option name="drilldown">row< /option>

< /table>

< /row>

< /dashboard>

I have an extracted field called "Filer" and right now all the data from every filer is being shown. What I would like to do is have a pull-down menu at the top of this dashboard that displays all the differing "Filers." Once a filer is selected from the pull down, all the data for that filer is shown in the graph and the table.

Thanks so much,
Matt

[watsm10]

Try this:

 

   NAS Usage

    

    

    

       

    

        

            

                  

[mmedal]

Splunk can still "not find the view." Your XML looks perfectly valid to me. 😕 Thanks for your continued assistance!

[mmedal]

It's almost exactly what what posted above.

   NAS Usage

    

    

    

       

    

        

                            <param name="value">$target$</param>
                        </param>
                    </param>
                </param>
                <module name="GenericHeader" layoutpanel="panel_row1_col1">
                        <param name="label">Total NAS Usage by Filer</param>
                </module>

                        <param name="search">index=usagereport sourcetype=nasreport_log Filer_Name="$filerName$" | rename Aggr as "Aggregate", Volume_Total as "Total Allocated", Volume_Used as "Used Space" | table Volume "Total Allocated" "Used Space" "Aggregate" | sort +Aggregate</param>
                        <module name="HiddenChartFormatter">
                          <param name="chart">line</param>
                          <module name="FlashChart">
                                <param name="width">100%</param>
                                <param name="height">300px</param>
                          </module>
                            <module name="JobProgressIndicator"/> 
                            </module>
                    </module>
    </module>
</module>

It seems to be valid XML and I don't believe any of these modules are deprecated or not supported. I could be wrong though...

[mmedal]

Couldn't get the XML to format properly in markdown....

[mmedal]

Thanks for your response. Yes, I have looked at the UI Examples app. The only problem is that certain seemingly key elements such as the ConvertToIntention module are not documented well and if I want to deviate even slightly from the UI Examples app, my views fail to load.

[watsm10]

I've done this myself very recently. You would assign a search to the drop down menu to populate it. I would suggest using something like | TOP 10 Filer (depending on how many filers there are) as this would speed up the population of the drop down.

Here is some code that I've put together to help you. If you have any questions, please ask!

 

   NAS Usage

    

    

    

       

    

        

<!-- ^ This displays the usual stuff at the top of the dashboard!-->

   

                

                    <module name="HiddenSearch" layoutPanel="panel_row1_col1">
                        <!--Your search which is populated from the dropdown!-->
                        <param name="search">index=usagereport sourcetype=nasreport_log Filer_Name="$filerName$" | rename Aggr as "Aggregate", Volume_Total as "Total Allocated", Volume_Used as "Used Space" | table Volume "Total Allocated" "Used Space" "Aggregate" | sort +Aggregate</param>
                        <module name="HiddenChartFormatter">
                          <param name="chart">line</param>
                          <module name="FlashChart"><!--Displays chart!-->
                                <param name="width">100%</param>
                                <param name="height">300px</param>
                          </module>
                            <module name="JobProgressIndicator" /> <!--Shows loading bar for results!-->
                            </module>
                    </module>
    </module>
</module>

[mmedal]

I have posted the XML below!

[Lowell]

While using top 20 may slightly decrease the drop-down rendering time in your browser by reducing the number of items displayed (which is normally negligible, depending on your exact use-case), you'd get the most speed up by limiting the search. (Either use a shorter time range or limit the number of events by adding in | head 1000 | top ..., for example.) Another good trick is to use metasearch command (when possible.) Just for clarification: The top command still has to load and tally all events before it can determine what the "top" values are, and that takes the most time.

[Lowell]

Also, make sure your XML is valid. (I use Komodo editor and it does XML validation as you work; which is a significant time saver.) Also, when your get annoyed and frustrated with "Intentions", you should want to check out Sideview Utils; it makes view development WAY easier and WAY more functional.

[watsm10]

It's when Splunk doesn't recognise the view as valid. This could be because there are unsupported modules/parameters in your code. It's probably worth looking through it and making sure everything is there that needs to be. Maybe post your code and I'll have a look when I've got time?

[mmedal]

Thanks for your response!! When I create a new view with this XML or change the xml on my existing dashboard to this xml, Splunk reports that it "cannot find the view." Any ideas on why that would be?

[Ayn]

I don't think you can do this in simple XML. Did you download and start looking at the UI examples app? It contains guidance on doing things like this.