Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
All Apps and Add-ons
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- How can I place a search bar above a sankey chart?
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hylam
Contributor
11-26-2015
11:02 PM
It should work like a search app with sankey chart visualization. The running search should cause the sankey chart and stats table to update. Don't forget the time picker.
EDIT1
wide text box + submit button + separate time picker should work, too.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MuS
Legend
11-29-2015
06:58 PM
Hi hylam,
take this run everywhere dashboard to see how it can be done:
<form script="autodiscover.js">
<label>my_foo_selector Clone</label>
<fieldset submitButton="ture">
<input type="time" token="time">
<label>Select time range:</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="text">
<label>Enter text to search:</label>
<default>*</default>
</input>
</fieldset>
<search id="viz_search">
<query>
<![CDATA[
index=_internal $text$ earliest="$time.earliest$" latest="$time.latest$" sourcetype=splunk_web_access NOT uri_path=*/static/* uri_path=*/app/* OR uri_path=*/manager/*
| rex field=referer "https?://.+?/.+?(?<referer_path>/[^\\?]+)"
| rex field=uri_path "/.+?(?<path>/.+)"
| rename referer_path as from path as to
| stats count by from to | sort -count | head 50
]]>
</query>
</search>
<row>
<panel>
<html>
<h2>Sankey</h2>
<div id="sankey" class="splunk-view" data-require="app/simple_xml_examples/components/sankey/sankey" data-options="{ "managerid": "viz_search", "height": 400 }">
</div>
</html>
</panel>
</row>
</form>
You must have the Simple XML dashboard example App installed https://splunkbase.splunk.com/app/1603/
Hope this helps to get you started and change / modify / add any additional charts as needed 😉
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MuS
Legend
11-29-2015
06:58 PM
Hi hylam,
take this run everywhere dashboard to see how it can be done:
<form script="autodiscover.js">
<label>my_foo_selector Clone</label>
<fieldset submitButton="ture">
<input type="time" token="time">
<label>Select time range:</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="text">
<label>Enter text to search:</label>
<default>*</default>
</input>
</fieldset>
<search id="viz_search">
<query>
<![CDATA[
index=_internal $text$ earliest="$time.earliest$" latest="$time.latest$" sourcetype=splunk_web_access NOT uri_path=*/static/* uri_path=*/app/* OR uri_path=*/manager/*
| rex field=referer "https?://.+?/.+?(?<referer_path>/[^\\?]+)"
| rex field=uri_path "/.+?(?<path>/.+)"
| rename referer_path as from path as to
| stats count by from to | sort -count | head 50
]]>
</query>
</search>
<row>
<panel>
<html>
<h2>Sankey</h2>
<div id="sankey" class="splunk-view" data-require="app/simple_xml_examples/components/sankey/sankey" data-options="{ "managerid": "viz_search", "height": 400 }">
</div>
</html>
</panel>
</row>
</form>
You must have the Simple XML dashboard example App installed https://splunkbase.splunk.com/app/1603/
Hope this helps to get you started and change / modify / add any additional charts as needed 😉
cheers, MuS
Get Updates on the Splunk Community!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...
Splunk APM: New Product Features + Community Office Hours Recap!
Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...
Index This | Forward, I’m heavy; backward, I’m not. What am I?
April 2024 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with another ...
