Developing Dashboards, Views, and Apps for Splunk Web

 


Switcher modules

NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Switcher modules

Switchers are useful for creating navigation within a view. You can use tabs or pulldown menus to switch between content. Switchers create a fork between different branches of XML, but the choice doesn't influence any individual search in the child branches. This is similar to lister modules, but lister modules allow for input that affects the searches in the child branches.

The Switcher modules that are most useful are:

  • PulldownSwitcher
  • TabSwitcher
  • LinkSwitcher

Here is an example using LinkSwitcher. There are more examples in the UI examples app, available from Splunkbase.

Add chrome

First add the chrome and nav for your page:

<view template="dashboard.html">
  <label>Switcher Intro</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  
  <module name="AppBar" layoutPanel="navigationHeader"/>
  
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>
   . . .
</view>

The group attributes can be confusing – sometimes they populate the dashboard panel titles, as in the module immediately below. But in the immediate child modules of switcher modules, the group attributes become the relevant label for the switcher element. For example, the tab's or pulldown option's text.

LinkSwitcher

This is a basic example using a LinkSwitcher with four children. All children use chart patterns.

Module Description
HiddenSearch Specifies a search to drive the chart.
HiddenChartFormatter Specifies custom charting configurations.
JobProgressIndicator (Optional) Displays the amount of chart remaining to load.
FlashChart Displays the actual Flash chart.

The last child adds a TimeRangePicker to drive the time of results.

. . .
<module name="LinkSwitcher" layoutPanel="panel_row2_col1">
  <param name="mode">independent</param>
  <param name="label"> </param>
. . .

First switcher child

The group attribute set on HiddenSearch governs the label that represents this branch in the switcher. For LinkSwitcher the label displays as a link.

. . .
<module name="HiddenSearch" group="cpu time by processor" autoRun="True">
  <param name="search">
    index="_internal" source="*metrics.log" group="pipeline" 
    | chart sum(cpu_seconds) over processor 
    | sort -sum(cpu_seconds) | head 10
  </param>

    <module name="HiddenChartFormatter">
      <param name="chart">line</param>
      <param name="primaryAxisTitle.text">CPU seconds</param>
      <param name="secondaryAxisTitle.text">Pipeline processors</param>
      <param name="legend.placement">right</param>
      
        <module name="JobProgressIndicator"/>
        
        <module name="FlashChart">
          <param name="width">100%</param>
          <param name="height">300px</param>
        </module>
        
    </module>
</module>
. . .

Second switcher child

. . .
<module name="HiddenSearch" group="KB Indexed by sourcetype" autoRun="True">
  <param name="search">
    index=_internal source=*metrics.log
    component=metrics group=per_sourcetype_thruput
    | chart sum(kb) by series | sort -sum(kb)
    | head 10
  </param>
  <param name="earliest">-1h</param>
  
    <module name="HiddenChartFormatter">
       <param name="chart">bar</param>
       <param name="primaryAxisTitle.text">Sourcetype</param>
       <param name="secondaryAxisTitle.text">KB Indexed</param>
       <param name="legend.placement">none</param>
       
         <module name="JobProgressIndicator"/>
         
         <module name="FlashChart">
           <param name="width">100%</param>
           <param name="height">300px</param>
         </module>
         
     </module>
</module>
. . .

Third switcher child

. . .
<module name="HiddenSearch" group="eps Indexed over time" autoRun="True">
  <param name="search">
    index=_internal source=*metrics.log
    component=metrics group=per_sourcetype_thruput
    | timechart avg(eps) by series
  </param>
  <param name="earliest">-1h</param>
  
    <module name="StaticContentSample">
      <param name="text">
        Some static text to describe the elements.
      </param>
    </module>
    
    <module name="HiddenChartFormatter">
      <param name="chart">line</param>
      <param name="primaryAxisTitle.text">Sourcetype</param>
      <param name="secondaryAxisTitle.text">events per second</param>
      <param name="legend.placement">right</param>
      
        <module name="JobProgressIndicator"/>
        
        <module name="FlashChart">
          <param name="width">100%</param>
          <param name="height">300px</param>
        </module>
        
     </module>
</module>
. . .

Fourth switcher child

This pattern uses HiddenSearch driven by a TimeRangePicker. Even though autoRun is set, (autoRun=true), the search does not run until given user input.

<module name="TimeRangePicker" group="Bucket Distribution">
  <param name="searchWhenChanged">True</param>
  <param name="selected">All time</param>
  
    <module name="HiddenSearch" autoRun="True">
      <param name="search">| dbinspect bins=400</param>
      
        <module name="HiddenChartFormatter">
          <param name="chart">line</param>
          <param name="primaryAxisTitle.text">Time</param>
          <param name="chartTitle">Distribution of index buckets over time</param>
          
            <module name="JobProgressIndicator"/>
            
            <module name="FlashChart"/>
            
        </module>
     </module>
</module>

This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 4.3.7 View the Article History for its revisions.


Comments

The examples given are largely taken from the "UI Examples" application, and as a stand alone example it throws a few issues.

The "first switcher child" example relies on the saved search "Pipeline processors with most processor time" being present on the system. Changing the 'savedSearch' to a straight 'search' with the following search should fix the problem:

index="_internal" source="*metrics.log" group="pipeline" | chart sum(cpu_seconds) over processor | sort -sum(cpu_seconds) | head 10

Also, using the XML for the "fourth switcher child" will give the switcher a title of "Splunk is unable to find a title for child #3" in the GUI. Putting 'group="Bucket Distribution"' in the TimePickerModule declaration will give a user friendly name.

Rturk
January 23, 2012

You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!