Splunk Search

one search multiple chart

mmattek
Path Finder

trying to consolidate (only erun search once. I see some example but without my dropdown feeding the seach. Can anyone help?

    <?xml version='1.0' encoding='utf-8'?>
<form>
  <label>ManagedServiceRuns</label>
  <fieldset>


      <input type="dropdown" token="thisclient">
        <label>client</label>

        <populatingSavedSearch fieldForValue="client" fieldForLabel="client">clientlistForJobs</populatingSavedSearch>
      </input>

      <!-- Add default TimePicker -->
      <input type="time" />

  </fieldset>  


  <row>
    <chart>
      <searchTemplate>sourcetype=jobinfo  client="$thisclient$" | fields JobDurationSecs, jobName | timechart max(JobDurationSecs)</searchTemplate>
      <title>ManagedServiceMaxTime Chart</title>
      <option name="charting.chart">line</option>
      <option name="charting.chart.nullValueMode">connect</option>
<option name="charting.legend.showMarkers">true</option>
    </chart>
  </row>
      <row>
        <chart>
      <searchTemplate>sourcetype=jobinfo  client="$thisclient$" | fields positionsAttempted |timechart max(positionsAttempted)</searchTemplate>
      <title>ManagedServiceRuns Positions Attempted Chart</title>
      <option name="charting.chart">line</option>
      <option name="charting.chart.nullValueMode">connect</option>
<option name="charting.legend.showMarkers">true</option>
    </chart>
  </row><row>   
     <chart>
      <searchTemplate>sourcetype=jobinfo  client="$thisclient$" | fields averageReportsSize |timechart max(averageReportsSize)</searchTemplate>
      <title>ManagedServiceRuns Averrage ReportSizeChart</title>
      <option name="charting.chart">line</option>
      <option name="charting.chart.nullValueMode">connect</option>
<option name="charting.legend.showMarkers">true</option>
    </chart>
  </row>

</form>
Tags (1)
0 Karma
1 Solution

tfletcher_splun
Splunk Employee
Splunk Employee

I think you may have to leave the world of simple and form xml behind and move into full blown view (advanced) xml.

This will do the trick in advanced xml (assuming I made no errors I do not have your searches and thus was unable to test):




    
    
    
    
        1
        *
        False
    
    
        1
        splunk.search.job
        True
    
    
        dashboard
    
    
        client
        
            
                client
                client
            
        
        clientlistForJobs
        
        False
        thisclient_setting
        
            thisclient_setting
            
                
                    
                        $target$
                        True
                    
                
                stringreplace
            
            
                False
                
                    Search
                    True
                    True
                    True
                    
                        sourcetype=jobinfo  client="$thisclient$" | fields averageReportsSize |timechart max(averageReportsSize)
                        
                            ManagedServiceMaxTime Chart
                            
                            
                                
                                    charting.chart.nullValueMode
                                    charting.chart
                                    charting.legend.showMarkers
                                
                                
                                    True
                                    
                                        
                                            False
                                            True
                                            
                                                connect
                                                line
                                                true
                                                
                                                    100%
                                                    
                                                    
                                                        
                                                            flashtimeline
                                                        
                                                    
                                                
                                                
                                                    flashtimeline
                                                
                                            
                                        
                                    
                                
                            
                        
                        
                            ManagedServiceRuns Positions Attempted Chart
                            
                            
                                
                                    charting.chart.nullValueMode
                                    charting.chart
                                    charting.legend.showMarkers
                                
                                
                                    True
                                    
                                        
                                            False
                                            True
                                            
                                                connect
                                                line
                                                true
                                                
                                                    100%
                                                    
                                                    
                                                        
                                                            flashtimeline
                                                        
                                                    
                                                
                                                
                                                    flashtimeline
                                                
                                            
                                        
                                    
                                
                            
                        
                        
                            ManagedServiceRuns Averrage ReportSizeChart
                            
                            
                                
                                    charting.chart.nullValueMode
                                    charting.chart
                                    charting.legend.showMarkers
                                
                                
                                    True
                                    
                                        
                                            False
                                            True
                                            
                                                connect
                                                line
                                                true
                                                
                                                    100%
                                                    
                                                    
                                                        
                                                            flashtimeline
                                                        
                                                    
                                                
                                                
                                                    flashtimeline
                                                
                                            
                                        
                                    
                                
                            
                        
                    
                
            
        
    


View solution in original post

tfletcher_splun
Splunk Employee
Splunk Employee

this should also be tagged with xml formxml advancedxml

0 Karma

tfletcher_splun
Splunk Employee
Splunk Employee

I think you may have to leave the world of simple and form xml behind and move into full blown view (advanced) xml.

This will do the trick in advanced xml (assuming I made no errors I do not have your searches and thus was unable to test):




    
    
    
    
        1
        *
        False
    
    
        1
        splunk.search.job
        True
    
    
        dashboard
    
    
        client
        
            
                client
                client
            
        
        clientlistForJobs
        
        False
        thisclient_setting
        
            thisclient_setting
            
                
                    
                        $target$
                        True
                    
                
                stringreplace
            
            
                False
                
                    Search
                    True
                    True
                    True
                    
                        sourcetype=jobinfo  client="$thisclient$" | fields averageReportsSize |timechart max(averageReportsSize)
                        
                            ManagedServiceMaxTime Chart
                            
                            
                                
                                    charting.chart.nullValueMode
                                    charting.chart
                                    charting.legend.showMarkers
                                
                                
                                    True
                                    
                                        
                                            False
                                            True
                                            
                                                connect
                                                line
                                                true
                                                
                                                    100%
                                                    
                                                    
                                                        
                                                            flashtimeline
                                                        
                                                    
                                                
                                                
                                                    flashtimeline
                                                
                                            
                                        
                                    
                                
                            
                        
                        
                            ManagedServiceRuns Positions Attempted Chart
                            
                            
                                
                                    charting.chart.nullValueMode
                                    charting.chart
                                    charting.legend.showMarkers
                                
                                
                                    True
                                    
                                        
                                            False
                                            True
                                            
                                                connect
                                                line
                                                true
                                                
                                                    100%
                                                    
                                                    
                                                        
                                                            flashtimeline
                                                        
                                                    
                                                
                                                
                                                    flashtimeline
                                                
                                            
                                        
                                    
                                
                            
                        
                        
                            ManagedServiceRuns Averrage ReportSizeChart
                            
                            
                                
                                    charting.chart.nullValueMode
                                    charting.chart
                                    charting.legend.showMarkers
                                
                                
                                    True
                                    
                                        
                                            False
                                            True
                                            
                                                connect
                                                line
                                                true
                                                
                                                    100%
                                                    
                                                    
                                                        
                                                            flashtimeline
                                                        
                                                    
                                                
                                                
                                                    flashtimeline
                                                
                                            
                                        
                                    
                                
                            
                        
                    
                
            
        
    


mmattek
Path Finder

That works very well, I just opened the xml file in vi and replaced it. It didn't like using the UI view for that. Thanks a lot!

0 Karma

tfletcher_splun
Splunk Employee
Splunk Employee

The edited version I have tested on 5.0.1. Should work in 4.3.5.

0 Karma

tfletcher_splun
Splunk Employee
Splunk Employee

yeah the issue is missing layout panels that's why nothing renders. just a moment...

0 Karma

tfletcher_splun
Splunk Employee
Splunk Employee

This is an advanced xml view. You probably need to follow the directions for creating an advanced xml view as the graphical editor for your form view most likely expected form xml.

0 Karma

mmattek
Path Finder

well, when I put that in the editor, now I can't find the view? Should I not have edited the exiting view? I guess I will try making a new one? btw, this is 4.3.5 if that matters

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...