Dashboards & Visualizations

tokens in advanced xml?

Azrielb
New Member

Hi, I tried this week to look into simple\advanced xml in splunk.
simple xml is "simple" enough to understand but I can't get the hang of the advanced one through the tutorials.
for example a simple form to create a chart with a token and a "time input":

<form>
  <label>New form</label>
  <searchTemplate>
  source="mysource" eventD=$eventD$  
    | stats sum(concurrentUsers) as concurrentbb by _time | timechart span=10m max(concurrentbb)
  </searchTemplate>  
<fieldset>
<input type="text" token="eventD">
  <label>eventD</label>
  <default></default>
  <seed>""</seed>
  <suffix></suffix>
</input>
<input type="time" />
</fieldset>

<row>
   <chart>
      <title>ConcurrentUsers</title>
      <option name="charting.chart">column</option>
      <option name="charting.primaryAxisTitle.text">User</option>
      <option name="charting.secondaryAxisTitle.text">ConcurrentUsers</option>
      <option name="charting.legend.placement">none</option>
      </chart>
  </row>

</form>


*** now I want to put this form inside a dashboard.
I managed to build a chart in it but I want to enable my users to insert values into tokens just like in the forms.

<view template="dashboard.html">
  <label>My Dashboard</label>

  <!-- top nav chrome -->
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>

  <!-- Renders the search box -->
  <module name="SearchBar" layoutPanel="mainSearchControls">

    <!-- Renders the resulting events from your search -->
    <module name="EventsViewer"/>

  </module><!-- close SearchBar module -->


  <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Messages per minute last hour" autoRun="True">
    <param name="search">source="analyticsreport" eventDescription=$eventD$ 
    | stats sum(concurrentUsers) as concurrentbb by _time | timechart span=10m max(concurrentbb)
    </param>

???????????????????????????????????????????????????????

  <module name="ResultsHeader">
      <param name="entityName">scanned</param>
      <param name="entityLabel">Events</param>

      <module name="FlashChart">
        <param name="height">180px</param>
        <param name="width">100%</param>
      </module>

    </module>
  </module>
</view>
Tags (2)
0 Karma

Damien_Dallimor
Ultra Champion

I would recommend installing the UI Examples app , it has plenty of examples of various Advanced XML Views that you can reference to create the functionality you want

Similarly, the Sideview Utils app , also has many examples of using the custom Sideview UI modules.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...