Searches, dashboards : simple XML questions

[NewMilenium]

Hello splunkers,

I made simple dashboards for my PDF reports. I musn't put any advanced XML into them so I still can use PDF generation. Each dashboard runs anyway on the last 31 days (I hope I can change that though, as you can see in problem 2).
My problems are the following :

1) Each dashboard contains only 8 to 10 views, because of the limit of jobs running at the same time, and the dashboard are awfully slow to process the results. Would there be a way to speed the searches..? Or to put all the views into only 1 dashboard (so, having less than 10 jobs with still more than 20 views)? Maybe have one search running over the last 31 days, then use those results to run several processes (1 for each view)?..? (in simple XML)


2) Is there any way to ask the user viewing the dashboard to enter the period of time only once for the whole dashboard (in simple XML)? I've not found how to do this...


3) I played around with several attributes, and I can't get to display any timechart with 31 VISIBLE days on it. I had to separate the search into 2 searches; one for -31 days to -16days, one for -15days to -1min. Anyone could help with that? (in simple XML)

Here is the first dashboard I've made (thanks pastebin).

Thank you for any help!

edit : oh, I forgot to mention; I've put those dashboards in Splunk for Fortigate application, just to benefit from the fields calculated in there.

[NewMilenium]

Thank you for your answer, jonuwz.
I've tried to apply what you linked me. But when I change the < dashboard> to a < form>, I can't print a PDF anymore. And of course it seems I can't put a < form> into a < dashboard>, nor keep it a < dashboard> with this < input> in it. If anyone knows what I could do to solve that...

I don't know why, but when I tried to show you the problem of displaying the 31 days at once, it didn't happen... Considering it solved until it happens again, then I'll compare (again) the XML.

[jonuwz]

Yes, yes and yes.

What you need is post processing.
Docs here - scroll down to the 'Single-search, multi-post process' part

This allows you to define 1 search that contains all the data you need, then you can slice and dice that data in the post processing

This should also take care of your '1 time to drive all the views' requirement.

I cant see any reason why the charts wouldn't display all 31 days - are there a lot of series in the charts ?

(Another alternative to post-processing would be to schedule the searches, but then you loose some interaction)

[NewMilenium]

Centos 5.5 GNU/Linux 64bits (a virtual machine), using splunk 5.0.2 ...
On a side note, I've installed a local pdf printer so I can print webpages into PDF documents, and it won't print the timecharts at all. If your solution can work, I'll look into it starting today. (I was sick the days before, sorry)

[jonuwz]

Thats the app i'm talking about. I've had no problems with that app on suse and rhel. As long as you understand it renders the page in firefox in the background using a virtual framebuffer (Xvfb), install the relevant OS packages to support that, it just works. Give me you OS, patch level and splunk version.

[NewMilenium]

Well, if you're talking about this one : http://splunk-base.splunk.com/apps/22348/pdf-report-server-install-on-linux-only then I've been told yesterday by splunkers on the IRC channel that this app' was a nightmare to debug, and was often having glitches, so, "a last resort solution", they said. Anyway, I already have it installed for months, and it's not permitting anything...
If not talking about this one, then I'm very eager to hear your solution. This would simply permit me to use advanced XML, so... would be excellent!

[jonuwz]

not with the out the box PDF capability no, there's a (in my opinion) much better PDF print server on splunk base that'll render pretty much anyhting as you see it on the screen.

[NewMilenium]

So both answers to my 2 first questions are "no" ?

And there is NO way to print PDF from Advanced XML?

[jonuwz]

Sorry - completely forgot you cant print forms.
Also, doesn't look like there's a way to specify a base search in a dashboard to use with searchPostProcess in simple XML.

[NewMilenium]

Thank you for your answer, jonuwz.
I've tried to apply what you linked me. But when I change the < dashboard> to a < form>, I can't print a PDF anymore. And of course it seems I can't put a < form> into a < dashboard>, nor keep it a < dashboard> with this < input> in it. If anyone knows what I could do to solve that...

I don't know why, but when I tried to show you the problem of displaying the 31 days at once, it didn't happen... Considering it solved until it happens again, then I'll compare (again) the XML.