This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6
This section contains several examples of different dashboard configurations.
<view template="dashboard.html">
<label>Advanced Dashboards - Intro</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="ServerSideInclude" layoutPanel="panel_row1_col1">
<param name="src">advanced_dashboard1.html</param>
</module>
<module name="StaticContentSample" layoutPanel="panel_row2_col1">
<param name="text">This is a basic example using HiddenSavedSearch + HiddenChartFormatter + FlashChart to show a flash chart from a saved search.</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row2_col1" group="Charting the results of a saved search" autoRun="True">
<param name="search">index=_internal source=*metrics.log Component=metrics group=per_sourcetype_thruput | chart sum(kb) by series | sort sum(kb) desc | head 10</param>
<param name="earliest">-1h</param>
<module name="HiddenChartFormatter">
<param name="chart">bar</param>
<param name="primaryAxisTitle.text">Sourcetype</param>
<param name="secondaryAxisTitle.text">KB Indexed</param>
<param name="legend.placement">none</param>
<module name="JobProgressIndicator"/>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">300px</param>
</module>
</module>
</module>
<module name="StaticContentSample" layoutPanel="panel_row2_col2" group="Allowing the user to change the time range">
<param name="text">This example uses HiddenSearch instead of HiddenSavedSearch, and includes a TimeRangePicker module to allow the user to change the time range.</param>
</module>
<module name="TimeRangePicker" layoutPanel="panel_row2_col2">
<param name="searchWhenChanged">True</param>
<param name="selected">All time</param>
<module name="HiddenSearch" autoRun="True">
<param name="search">| dbinspect bins=400</param>
<module name="HiddenChartFormatter">
<param name="chart">line</param>
<param name="primaryAxisTitle.text">Time</param>
<param name="chartTitle">Distribution of index buckets over time</param>
<module name="JobProgressIndicator"/>
<module name="FlashChart"/>
</module>
</module>
</module>
<module name="StaticContentSample" layoutPanel="panel_row3_col1">
<param name="text">This example redirects the user to see the same graph in the charting view using a simple module called ViewRedirectorLink.</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row3_col1" group="Simple Redirects - 1" autoRun="True">
<param name="search">index=_internal source=*metrics.log Component=metrics group=per_sourcetype_thruput | timechart sum(kb)</param>
<param name="earliest">-1h</param>
<module name="HiddenChartFormatter">
<param name="chart">line</param>
<param name="primaryAxisTitle.text">time</param>
<param name="secondaryAxisTitle.text">KB Indexed</param>
<param name="legend.placement">right</param>
<module name="JobProgressIndicator"/>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">200px</param>
</module>
<module name="ViewRedirectorLink" layoutPanel="panel_row3_col1">
<param name="viewTarget">charting</param>
<param name="label">Redirect 1</param>
</module>
</module>
</module>
<module name="StaticContentSample" layoutPanel="panel_row3_col2">
<param name="text">This example redirects the user to see the same graph in the charting view using a pair of modules, SubmitButton + ViewRedirector. Just for fun we added a TimeRangePicker above the SubmitButton which allows the user to change the timerange before the redirect.</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row3_col2" group="Simple Redirects - 2" autoRun="True">
<param name="search">index=_internal source=*metrics.log Component=metrics group=per_sourcetype_thruput | timechart sum(kb)</param>
<param name="earliest">-1h</param>
<module name="HiddenChartFormatter">
<param name="chart">line</param>
<param name="primaryAxisTitle.text">time</param>
<param name="secondaryAxisTitle.text">KB Indexed</param>
<param name="legend.placement">right</param>
<module name="JobProgressIndicator"/>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">200px</param>
</module>
<module name="TimeRangePicker">
<param name="searchWhenChanged">True</param>
<param name="selected">Today</param>
<module name="SubmitButton">
<param name="label">Redirect 2</param>
<module name="ViewRedirector">
<param name="viewTarget">charting</param>
</module>
</module>
</module>
</module>
</module>
<module name="ServerSideInclude" layoutPanel="panel_row4_col1">
<param name="src">advanced_dashboard1_summary.html</param>
</module>
</view>
<view template="dashboard.html">
<label>Advanced Dashboards - Drilldown patterns</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="StaticContentSample" layoutPanel="panel_row1_col1">
<param name="text">These examples demonstrate a few 'drilldown' patterns for dashboards that are particularly useful. There is an enormous range of possible configurations and these are only a couple examples.</param>
</module>
<module name="StaticContentSample" layoutPanel="panel_row2_col1">
<param name="text">This simple example uses a complex SearchSelectLister that generates the 10 sourcetypes with the most data indexed in the last hour. The user can then pick one and then we redirect them to flashtimeline and run a search for just the events from that sourcetype, this time over the past 2 hours. </param>
</module>
<!-- our base search will just be "*", over the past 2 hours -->
<module name="HiddenSearch" layoutPanel="panel_row2_col1" group="Drilldowns - 1" autoRun="True">
<param name="search">*</param>
<param name="earliest">-2h</param>
<module name="SearchSelectLister">
<param name="settingToCreate">series_setting</param>
<param name="search">index=_internal metrics NOT source="*web_service.log" NOT source="*access.log" NOT source="*/searches.log" NOT source="*intentions.log" NOT source="*splunkd.log" group="per_sourcetype_thruput" | chart sum(kb) over series | sort sum(kb) desc | head 10 | sort series</param>
<param name="earliest">-1h</param>
<param name="label">source</param>
<param name="searchWhenChanged">True</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">series</param>
<param name="value">series</param>
</list>
</param>
<module name="ConvertToIntention">
<param name="settingToConvert">series_setting</param>
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="sourcetype">$target$</param>
</param>
</param>
<module name="SubmitButton">
<param name="label">Drilldown 1</param>
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
<module name="StaticContentSample" layoutPanel="panel_row2_col2">
<param name="text">This example is the same except instead of SearchSelectLister we use SearchLinkLister and ViewRedirector. The takeaway is that the listers are all interchangeable. ie if you'd rather have radio buttons just use SearchRadioLister.</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row2_col2" group="Drilldowns - 2" >
<param name="search">*</param>
<param name="earliest">-2h</param>
<module name="SearchLinkLister">
<param name="settingToCreate">series_setting</param>
<param name="search">index=_internal metrics NOT source="*web_service.log" NOT source="*access.log" NOT source="*/searches.log" NOT source="*intentions.log" NOT source="*splunkd.log" | chart sum(kb) over series | sort sum(kb) desc | head 10 | sort series</param>
<param name="earliest">-1h</param>
<param name="searchWhenChanged">True</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">series</param>
<param name="value">series</param>
</list>
</param>
<module name="ConvertToIntention">
<param name="settingToConvert">series_setting</param>
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="sourcetype">$target$</param>
</param>
</param>
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
<module name="StaticContentSample" layoutPanel="panel_row3_col1">
<param name="text">
This example uses a SearchSelectLister to give the list of indexes. Then a second SearchSelectLister generates a link for each sourcetype within the chosen index.
</param>
</module>
<module name="StaticContentSample" layoutPanel="panel_row3_col1">
<param name="text">
Then when the user chooses a sourcetype from the second pulldown we will construct a third search for index="foo" sourcetype="bar". When the user clicks the SubmitButton module this search will travel down, hit a module called ViewRedirector, and off the user goes.
</param>
</module>
<module name="StaticContentSample" layoutPanel="panel_row3_col1">
<param name="text">
Just for fun we also have configured the ViewRedirector module to launch a popup window, and instead of flashtimeline we use a simple stripped down view that we made just for this app.
</param>
</module>
<module name="SearchSelectLister" layoutPanel="panel_row3_col1" group="Drilldowns - 3">
<param name="label">which index</param>
<param name="settingToCreate">index_setting</param>
<param name="search">| eventcount summarize=false index=* | search index!="splunklogger" index!="summary" index!="history" | sort index desc</param>
<param name="searchWhenChanged">True</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">index</param>
<param name="value">index</param>
</list>
</param>
<module name="ConvertToIntention">
<param name="settingToConvert">index_setting</param>
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="index">
<param name="fillOnEmpty">True</param>
<param name="prefix">index=</param>
<param name="value">$target$</param>
</param>
</param>
</param>
<module name="SearchSelectLister">
<param name="label">Sourcetype</param>
<param name="settingToCreate">sourcetype_setting</param>
<param name="search">| metadata type="sourcetypes" $index$</param>
<param name="applyOuterIntentionsToInternalSearch">True</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">sourcetype</param>
<param name="value">sourcetype</param>
</list>
</param>
<module name="HiddenSearch">
<param name="search">$index$ $sourcetype$</param>
<module name="ConvertToIntention">
<param name="settingToConvert">sourcetype_setting</param>
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="sourcetype">
<param name="fillOnEmpty">True</param>
<param name="prefix">sourcetype=</param>
<param name="value">$target$</param>
</param>
</param>
</param>
<module name="SubmitButton">
<param name="label">Search</param>
<module name="ViewRedirector">
<param name="viewTarget">really_simple_viewer</param>
<param name="popup">True</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="StaticContentSample" layoutPanel="panel_row3_col2">
<param name="text">very similar except that the second is a SearchLinkLister. Beware that prior to 4.0.3 there is a bug in this configuration.(SPL-25464).</param>
</module>
<module name="SearchSelectLister" layoutPanel="panel_row3_col2" group="Drilldowns - 4">
<param name="label">which index</param>
<param name="settingToCreate">index_setting</param>
<param name="search">| eventcount summarize=false index=* | search index!="splunklogger" index!="summary" index!="history" | sort index desc</param>
<param name="searchWhenChanged">True</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">index</param>
<param name="value">index</param>
</list>
</param>
<module name="ConvertToIntention">
<param name="settingToConvert">index_setting</param>
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="index">
<param name="fillOnEmpty">True</param>
<param name="prefix">index=</param>
<param name="value">$target$</param>
</param>
</param>
</param>
<module name="SearchLinkLister">
<param name="settingToCreate">sourcetype_setting</param>
<param name="search">| metadata type="sourcetypes" $index$</param>
<param name="applyOuterIntentionsToInternalSearch">True</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">sourcetype</param>
<param name="value">sourcetype</param>
</list>
</param>
<module name="HiddenSearch">
<param name="search">$index$ $sourcetype$</param>
<module name="ConvertToIntention">
<param name="settingToConvert">sourcetype_setting</param>
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="sourcetype">
<param name="fillOnEmpty">True</param>
<param name="prefix">sourcetype=</param>
<param name="value">$target$</param>
</param>
</param>
</param>
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="StaticContentSample" layoutPanel="panel_row4_col1">
<param name="text">Now we take a bunch of leaps ahead and put it all together. We put in a Sorter module, a Paginator module. We put in a HiddenSearch+SimpleResultsHeader pattern to give us 'Sources (208)'. Then we duplicate the same pattern for both Sourcetypes and Hosts. (NOTE: prior to 4.0.3 a bug will make this configuration not work, specifically because of the presence of the Paginator. SPL-25516)</param>
</module>
<module name="SearchSelectLister" layoutPanel="panel_row4_col1" group="Drilldowns - 5">
<param name="label">which index</param>
<param name="settingToCreate">index_setting</param>
<param name="search">| eventcount summarize=false index=* | search index!="splunklogger" index!="summary" index!="history" | sort index desc</param>
<param name="searchWhenChanged">True</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">index</param>
<param name="value">index</param>
</list>
</param>
<!-- Here is where we take the generic setting value outputted by the SearchSelectLister, and
we turn that into an intention.
Ultimately this one intention will be consumed in 6 different places.
We will use the combination of HiddenSearch + SimpleResultsHeader in the first 3 child-branches
to generate the 'Sourcetypes (14)' headers.
Then we will have 3 SearchLinkLister modules configured with applyOuterIntentionsToInternalSearch="True"
-->
<module name="ConvertToIntention">
<param name="settingToConvert">index_setting</param>
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="index">
<param name="fillOnEmpty">True</param>
<param name="prefix">index=</param>
<param name="value">$target$</param>
</param>
</param>
</param>
<module name="HiddenSearch">
<param name="search">| metadata type=sources $index$</param>
<module name="SimpleResultsHeader" layoutPanel="panel_row4_col1_grp1">
<param name="entityName">results</param>
<param name="headerFormat">Sources (%(count)s)</param>
</module>
</module>
<module name="HiddenSearch">
<param name="search">| metadata type=sourcetypes $index$</param>
<module name="SimpleResultsHeader" layoutPanel="panel_row4_col1_grp2">
<param name="entityName">results</param>
<param name="headerFormat">Sourcetypes (%(count)s)</param>
</module>
</module>
<module name="HiddenSearch">
<param name="search">| metadata type=hosts $index$</param>
<module name="SimpleResultsHeader" layoutPanel="panel_row4_col1_grp3">
<param name="entityName">results</param>
<param name="headerFormat">Hosts (%(count)s)</param>
</module>
</module>
<!-- from here on inward, it's all just dealing with sources. We put each of these 3 branches
in its own grp layoutPanel so that they will all float alongside eachother
within the same panel. -->
<module name="Sorter" layoutPanel="panel_row4_col1_grp1">
<param name="sortKey">totalCount</param>
<param name="sortDir">desc</param>
<param name="fields">
<list>
<param name="label">Source</param>
<param name="value">source</param>
</list>
<list>
<param name="label">Total Count</param>
<param name="value">totalCount</param>
</list>
<list>
<param name="label">First Time</param>
<param name="value">firstTime</param>
</list>
</param>
<module name="Paginator">
<param name="count">10</param>
<param name="entityName">settings</param>
<param name="maxPages">10</param>
<!-- the module that generates the blue links. Note that it although it configures its own internal search,
it has a flag that allows it to apply intentions from the main context, to its internal search.
-->
<module name="SearchLinkLister">
<param name="settingToCreate">list1</param>
<param name="search">| metadata type=sources $index$</param>
<param name="applyOuterIntentionsToInternalSearch">True</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">source</param>
<param name="value">source</param>
</list>
<list>
<param name="label">totalCount</param>
<param name="labelFormat">number</param>
</list>
</param>
<!-- Further upstream we used ConvertToIntention to make a stringreplace intention for a metadata search.
Here we use it again, this time to convert the same setting to a simpler addterm intention.
(the first intention will have been consumed by the searchSelectLister, but the setting will still be there ) -->
<module name="ConvertToIntention">
<param name="settingToConvert">index_setting</param>
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="index">$target$</param>
</param>
</param>
<!-- This takes some getting used to, but here is where we take the setting generated by the SearchLinkLister
when the user clicks a link, and convert that into an intention. -->
<module name="ConvertToIntention">
<param name="settingToConvert">list1</param>
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="source">$target$</param>
</param>
</param>
<!-- And finally, whenever any context information hits this ViewRedirector we will instantly redirect.
because of the internals of 'SearchLinkLister', nothing will arrive here until the moment of the user
clicking the blue link -->
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
<!-- from here on inward, it's all just dealing with sourcetypes -->
<module name="Sorter" layoutPanel="panel_row4_col1_grp2">
<param name="sortKey">totalCount</param>
<param name="sortDir">desc</param>
<param name="fields">
<list>
<param name="label">Sourcetype</param>
<param name="value">sourcetype</param>
</list>
<list>
<param name="label">Total Count</param>
<param name="value">totalCount</param>
</list>
<list>
<param name="label">First Time</param>
<param name="value">firstTime</param>
</list>
</param>
<module name="Paginator">
<param name="count">10</param>
<param name="entityName">settings</param>
<param name="maxPages">10</param>
<!-- the module that generates the blue links. Note that it although it configures its own internal search,
it has a flag that allows it to apply intentions from the main context, to its internal search.
-->
<module name="SearchLinkLister">
<param name="settingToCreate">list1</param>
<param name="search">| metadata type=sourcetypes $index$</param>
<param name="applyOuterIntentionsToInternalSearch">True</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">sourcetype</param>
<param name="value">sourcetype</param>
</list>
<list>
<param name="label">totalCount</param>
<param name="labelFormat">number</param>
</list>
</param>
<!-- Further upstream we used ConvertToIntention to make a stringreplace intention for a metadata search.
Here we use it again, this time to convert the same setting to a simpler addterm intention.
(the first intention will have been consumed by the searchSelectLister, but the setting will still be there ) -->
<module name="ConvertToIntention">
<param name="settingToConvert">index_setting</param>
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="index">$target$</param>
</param>
</param>
<!-- This takes some getting used to, but here is where we take the setting generated by the SearchLinkLister
when the user clicks a link, and convert that into an intention. -->
<module name="ConvertToIntention">
<param name="settingToConvert">list1</param>
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="sourcetype">$target$</param>
</param>
</param>
<!-- And finally, whenever any context information hits this ViewRedirector we will instantly redirect.
because of the internals of 'SearchLinkLister', nothing will arrive here until the moment of the user
clicking the blue link -->
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
<!-- from here on inward, it's all just dealing with hosts -->
<module name="Sorter" layoutPanel="panel_row4_col1_grp3">
<param name="sortKey">totalCount</param>
<param name="sortDir">desc</param>
<param name="fields">
<list>
<param name="label">Host</param>
<param name="value">host</param>
</list>
<list>
<param name="label">Total Count</param>
<param name="value">totalCount</param>
</list>
<list>
<param name="label">First Time</param>
<param name="value">firstTime</param>
</list>
</param>
<module name="Paginator">
<param name="count">10</param>
<param name="entityName">settings</param>
<param name="maxPages">10</param>
<!-- the module that generates the blue links. Note that it although it configures its own internal search,
it has a flag that allows it to apply intentions from the main context, to its internal search.
-->
<module name="SearchLinkLister">
<param name="settingToCreate">list1</param>
<param name="search">| metadata type=hosts $index$</param>
<param name="applyOuterIntentionsToInternalSearch">True</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">host</param>
<param name="value">host</param>
</list>
<list>
<param name="label">totalCount</param>
<param name="labelFormat">number</param>
</list>
</param>
<!-- Further upstream we used ConvertToIntention to make a stringreplace intention for a metadata search.
Here we use it again, this time to convert the same setting to a simpler addterm intention.
(the first intention will have been consumed by the searchSelectLister, but the setting will still be there ) -->
<module name="ConvertToIntention">
<param name="settingToConvert">index_setting</param>
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="index">$target$</param>
</param>
</param>
<!-- This takes some getting used to, but here is where we take the setting generated by the SearchLinkLister
when the user clicks a link, and convert that into an intention. -->
<module name="ConvertToIntention">
<param name="settingToConvert">list1</param>
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="host">$target$</param>
</param>
</param>
<!-- And finally, whenever any context information hits this ViewRedirector we will instantly redirect.
because of the internals of 'SearchLinkLister', nothing will arrive here until the moment of the user
clicking the blue link -->
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="ServerSideInclude" layoutPanel="panel_row5_col1">
<param name="src">advanced_dashboard2_summary.html</param>
</module>
</view>