Solved: Saved searches not working via xml in view/dashboa...

aportela · ‎07-31-2013

Have xml code used to generate view / dashboard, am trying to directly call "saved search" to produce output. Have tried to use the searchName and searchString tags, but neither of these work. However, xml code works when i use the actual search command string with the "param name=search" tag.

Are these tags not allowed in HTML panels? If not allowed, is there a command(s) that will permit directly calling "saved searches"? Or, do i need to re-write the view as another type of panel that is not HTML (e.g., table, etc.)?

Any and all help would be much appreciated.
Thanks... Al

sowings · ‎07-31-2013

You've asked if the searchName and searchString tags are valid in HTML panels. So I'm guessing you're doing something like this:

<dashboard> <row> <html> <searchName> ... </searchName> </html> </row> </dashboard>

You can use searchName as a child of a <table>, <chart>,<event>, <single> or <list>.

See here for more info. I've written dashboards in Simple XML with both searchName referencing a named saved search, as well as searchString with the whole string.

View solution in original post

sowings · ‎07-31-2013

You've asked if the searchName and searchString tags are valid in HTML panels. So I'm guessing you're doing something like this:

<dashboard> <row> <html> <searchName> ... </searchName> </html> </row> </dashboard>

You can use searchName as a child of a <table>, <chart>,<event>, <single> or <list>.

See here for more info. I've written dashboards in Simple XML with both searchName referencing a named saved search, as well as searchString with the whole string.

Saved searches not working via xml in view/dashboard

Introducing Splunk Enterprise 9.2

Adoption of RUM and APM at Splunk

Routing logs with Splunk OTel Collector for Kubernetes