Dashboards & Visualizations

Automatically run searchPostProcess in a simple XML dashboard?

msarro
Builder

Hello, I am trying to create a dashboard which will eventually be implemented in advanced XML, but the more I can do in simple xml the better.

That said, I am having issue trying to get this to work. I have a searchTemplate, and my panels each has a searchPostProcess element. However, unless I convert the dashboard to a form and include some sort of fieldset (somewhere I can hit "submit", the panels just sit there with no value. Once I hit the submit button, they work.

Is there a way to get it to autorun? Ultimately this dashboard doesn't need user input, it should just run. I know that there is an auto-run option for some of the elements but I can't seem to find a decent reference for simple XML.

Tags (1)
0 Karma
1 Solution

msarro
Builder

I was able to get it to work this way:

?xml version='1.0' encoding='utf-8'?
form
  fieldset autoRun="true" submitButton="false"
  /fieldset
earliestTime -30d@d /earliestTime

View solution in original post

msarro
Builder

I was able to get it to work this way:

?xml version='1.0' encoding='utf-8'?
form
  fieldset autoRun="true" submitButton="false"
  /fieldset
earliestTime -30d@d /earliestTime

msarro
Builder

The major goal was to avoid having the same base search run 7+ times for what will eventually be 12 different tabs on each page. It wouldn't be a big deal except the base search is somewhat lengthy to run.

0 Karma

aholzer
Motivator

Is there any reason you are using a searchTemplate rather than a saved search for your base search?

I believe that the simple XML requires you to define an input if you have a searchTemplate. If you use a saved search on the other hand I believe it defaults to "autorun=true".

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...