Panel reference for simple XML

Panel reference for simple XML

If you're building a simple dashboard or form search, use any of the panels listed below. Panels take various configuration options, as well as a few general settings that can be applied to most of the panels listed below. The general settings include:

• title = title
  • Add a title to your panel, such as Failed logins. This title display at the top of the panel.
• searchName = saved search
  • Specify a saved search to load in your panel. Make sure this saved search is shared with all users and roles who access this dashboard. Any saved search referenced in searchName must exist in savedsearches.conf in the App's default or local directory or be set as global.
• searchString = search string
  • Specify an inline search to run whenever the dashboard loads.
• fields = comma separated list of fields
  • Restrict your search results to specific fields.
• earliestTime = Splunk time format
  • Restrict your search results to a specific time window, starting with the earliestTime.
• latestTime = Splunk time format
  • Restrict your search results to a specific time window, ending with the latestTime.

Example

Here's an example of a table panel with three general options and two panel specific options.

<table>
    <title>Look here for errors that you need to care about</title>
    <searchName>Errors in the last 24 hours</searchName>
    <fields>host, source, errorNumber</fields>
    <option name="count">25</option>
    <option name="displayRowNumbers">true</option>
</table>

table

The table panel displays search data as a table. Use the searchName attribute to specify which saved search results to display as a table. Use other general options as specified above.

Options for table

Here are table specific options.

• count = integer
  • The maximum number of rows to display.
• displayRowNumbers = true | false
  • Toggle display of row numbers to the left of results.
• showPager = true | false
  • Show paging in the table.

Example

Here's an example snippet of a table panel. Set this in a row within a dashboard.

...
  <table>
    <title>Look here for errors that you need to care about</title>
    <searchName>Errors in the last 24 hours</searchName>
    <option name="count">25</option>
    <option name="displayRowNumbers">true</option>
 </table>
...

chart

The chart panel displays search data in chart format. Pair the chart panel with a saved report you've already created. Saved reports contain chart formatting parameters. Saved searches, on the other hand, do not. For more information, see "Saving reports and sharing them with others" in the User manual.

When you load a saved report in the chart panel, your saved report format will also be loaded. However, chart formatting can be overridden inline via the options. Charts support all the general options listed above as well as chart specific options listed below.

Options for chart

Here are chart specific options.

• height = CSS dimension
  • Set the height of the chart.
• charting.chart = bar | line | column | area | pie | scatter | bubble
  • Set the chart type.
• charting.legend.placement = top | left | bottom | right | none
  • Indicates the placement of the legend.
• charting.* = charting options
  • All of the chart formatting options are supported here; see the custom charting configuration reference chapter in this Manual.

Example

Here's an example snippet of a chart panel. Set this in a row within a dashboard.

...
<chart>
  <searchString>index=_internal metrics group="pipeline" NOT sendout | 
head 1000 | timechart per_second(cpu_seconds) by processor</searchString>
  <earliestTime>-30h</earliestTime>
  <latestTime>-10h</latestTime>
  <option name="charting.chart">line</option>
  <option name="charting.primaryAxisTitle.text">Time</option>
  <option name="charting.secondaryAxisTitle.text">Load (%)</option>
</chart>
...

event

The event panel displays the search results as individual events. This panel supports the general options listed above and the following options.

• count = integer
  • The maximum number of rows to display.
• displayRowNumbers = true | false
  • Toggle whether row numbers are shown to the left of results.
• entityName = events | results
  • Toggle whether to show events or results. Events are individual events, while results are created by statistical operators.
  • Defaults to results.
• segmentation = none | inner | outer | full
  • Set the segmentation of events displayed. This affects what you can and can't click on within the event.
• maxLines = integer
  • The maximum number of lines to display for each result/event.
• showPager = true | false
  • Toggle pagination on or off.

Example

Here's an example snippet of an event panel. Set this in a row within a dashboard.

...
<event>
  <title>Event view</title>
  <searchString>changelist | head 1000 | dedup changelist</searchString>
  <fields>added deleted changed</fields>
  <option name="showPager">true</option>
  <option name="count">20</option>
  <option name="displayRowNumbers">false</option>
</event>
...

single

The single panel displays a single value (the first row/first column) from search data, regardless of the total size of the dataset. You can change the color of the panel depending on what your search returns. This panel support the following options:

• additionalClass = css class name
  • An optional additional css class name to add to the result container.
• linkView = view
  • Specify which view to execute the linked search against.
  • Defaults to dashboard.
• field = field
  • Field to display.
  • Defaults to first field returned.
• linkFields = result | beforeLabel | afterLabel
  • Set which part of the text in the single value to use as a link.
  • To link the result and both labels, set as result,beforeLabel,afterLabel.
  • Defaults to result.
• classField = class | severe | elevated | low | None
  • Adds the value of the classField of the first result as an additional CSS class to the result container.
  • Pre-defined classes include 'severe', 'elevated', 'low', and 'None' (default).
• beforeLabel = text
  • Label to display before the result.
• afterLabel = text
  • Label to display after the result.
• linkSearch = search query
  • Specify a valid complete search query to turn the result into a clickable link.

Example

Here's an example snippet of a single panel. Set this in a row within a dashboard.

<single>
  <searchString>| metadata type="sources" | stats count</searchString>
  <option name="afterLabel">sources</option>
</single>

If you want to change colors on your single results panel, set up your search with range map:

<single>
    <searchString>index=_internal 404 source="*web_access.log" earliest=-1h |
stats count | rangemap field=count low=0-0 elevated=1-100 default=severe</searchString>
      <title>404s this hour</title>
      <option name="classField">range</option>
</single>

html

The html panel displays inline HTML. The entire contents between the HTML tags will be interpreted literally, and displayed on the page. Remember that any link references, i.e. images, will be relatively homed to the current view location. The html panel does not use any options above (except title) and there are no specific options to set for html.

Example

<html>
    This lists all of the data you have loaded into <strong>your</strong> default indexes over all time.
</html>

list

The list panel displays data in a list. Use this panel to display information from saved searches or search results. This panel supports the following options.

Required options for list

• labelField = field name
  • The field you want to use to generate labels for your list.
• valueField = field name
  • The field you want to use to generate values for the labels in your list.

Optional options for list

• initialSortDir = asc | desc
  • The direction to sort the results based on the initialSort field.
• labelFieldSearch = search string
  • The search string to generate when the user clicks on the label field.
  • Requires labelFieldTarget to be defined to a valid view.
  • The value of the label field is automatically added to the search.
• valueField
  • The name of the result field whose value should be displayed in the label part of the link list.
  • Link lists are generally a combination of a descriptive label and a numeric count or other (value) field.
  • Required.
• labelFieldTarget
  • The view to target if the label field is setup to generate a clickable link that dispatches a search.
  • Optional
• initialSort
  • The field in the result set to sort on when the link list is first rendered.
  • Optional

Example

Here's a snippet of a list panel. Set this in a row within your dashboard.

<list>
    <searchName>Top recipients</searchName>
    <option  name="labelField">to</option>
    <option  name="valueField">to</option>
</list>

• Was this topic useful?
• Post a comment