Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

StaticSelect and SavedSearches

$
0
0

Hi. Got a big trouble to make this working, hope you can help me :) I want something simple : I got a Timerangepicker that i can use to change all my savedSearches in my dashboard. I yant to add a Select to choose the sourcetype. I got 4 masterservers that index their data into splunk with 4 different Sourcetype (Netbackup_GVA,Netbackup_GIB,Netbackup_NAS,Netbackup_BER) In my dashboard i want to change my graphs depending on this Sourcetype (And date but this part is working)

Here is my simplified xml :

<view isVisible="true"  template="dashboard.html">      
<module name="StaticSelect" layoutPanel="panel_row1_col1">
    <param name="settingToCreate">group_setting</param>
    <param name="searchWhenChanged">True</param>
    <param name="staticFieldsToDisplay">
        <list>
            <param name="label">GVA</param>
            <param name="value">Netbackup_GVA</param>
        </list>
        <list>
            <param name="label">GIB</param>
            <param name="value">Netbackup_GIB</param>
        </list>
        <list>
            <param name="label">NAS</param>
            <param name="value">Netbackup_NAS</param>
        </list>
        <list>
            <param name="label">BER</param>
            <param name="value">Netbackup_BER</param>
        </list>
    </param>
    <module name="ConvertToIntention">
        <param name="settingToConvert">group_setting</param>
        <param name="intention">
            <param name="arg">
                <param name="sourcetype">
                    <param name="value">$target$</param>
                </param>
            </param>
            <param name="name">stringreplace</param>
        </param>

        <module name="TimeRangePicker" layoutPanel="panel_row1_col1">
            <param name="searchWhenChanged">True</param>
            <!-- HiddenSearch R2C1 -->
            <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Last client backed up" autoRun="True">
                <param name="savedSearch">summary_CountJobsFirst</param>
                <module name="EnablePreview">
                    <param name="enable">True</param>
                    <param name="display">False</param>
                    <module name="HiddenFieldPicker">
                        <module name="SingleValue">
                            <param name="beforeLabel">First backup  : </param>
                            <param name="linkSearch">*</param>
                            <param name="linkView">flashtimeline</param>
                        </module>
                    </module>
                </module>       
            </module>
            <!-- MANY OTHERS HiddenSavedSearch here -->
        </module><!-- TimerangePicker -->
    </module><!-- ConvertToIntention -->    
</module><!-- StaticSelect -->
</view>

And my savedsearches look like : [summary_CountJobsFirst] search = sourcetype=$sourcetype$ | head 1|convert timeformat="%b %d (%a), %H:%M:%S" ctime(_time) as Date |table Date

Do i miss something? Thx a lot for your help.


Viewing all articles
Browse latest Browse all 13053

Trending Articles