Application with tables with parameters for the inline search?

[feniix]

Hello,

I am building a small splunk app and I have a dashboard that has many tables with inline searches like this:

app2audit AND (Instance=USCASF) AND (Period=201009)| eval Date=_time | convert timeformat="%Y%m%d-%H:%M" ctime(Date) | table Date, Host, Artifact, Size, LastMod | sort Date

What I would like to do is put a html row that has a combo box with a list like: 201009, 201010, 201011, 201012.

And then when I select one option from the html combo box it passes the variable to the "Period" field in the inline search in all the tables and updates the tables.

Is that possible?

[David · Accepted solution]

Absolutely. It sounds like a Lister module would work very well. I'd suggest looking at the UI examples app from splunkbase. There are a wide variety of examples of how to use it. But in short:

1. You'll need to use Advanced XML. (Switch to advanced XML: http://answers.splunk.com/questions/1/how-can-i-convert-simple-view-xml-to-advanced-xml . Fix issue with switching to advanced XML, if you get the "unicode" object has no attribute "get" error -- I usually / always get this: http://answers.splunk.com/questions/3606/unicode-object-has-no-attribute-get/3665#3665 .)
2. You can add a Lister module: http://www.splunk.com/base/Documentation/latest/Developer/HowToUseListers
3. Your lister module can be based on a search for app2audit Instance=USCASF | stats count by Period | sort - Period
4. You could even add the ability to specify either the Instance, or the Period, and then get a dropdown of Instances / Periods, depending on your selection. (See the UI Examples app for an example of how this works: http://splunkbase.splunk.com/apps/All/4.x/Add-On/app:UI+Examples .)
5. As an aside: You'll likely want to set up a summary index for however you determine your available Periods, as this will be an additional search. If you need to go through 300,000 records to get a list of the Periods, your users will have to wait for that to complete before they can even select the search. Even if you only have to go through 10,000, the slowdown will be noticeable. ( http://www.splunk.com/view/SP-CAAACZW )