Developing Dashboards, Views, and Apps for Splunk Web

Panel reference for Simplified XML

Use the panel reference when building simple dashboards or from searches from Splunk's Simplified XML. It lists configuration options for the various types of panels you can use, plus includes an example configuration for each.

There are general settings that can be applied to all panels. Different types of panels have specific configuration options.

General panel configuration

Options for all panels

Tag	Description
<title>title</title>	Add a title to your panel, such as Failed logins. This title display at the top of the panel.
<searchName>saved search</searchName>	Specify a saved search to load in your panel. Make sure the saved search is shared with all users and roles who access the dashboard. The saved search must exist in savedsearches.conf in the App's default or local directory, the user's directory for private apps, or be set as global.
<searchString>search string</searchString>	Specify an inline search to run whenever the dashboard loads.
<fields>comma separated list of fields</fields>	Restrict your search results to specific fields.
<earliestTime>Splunk time format</earliestTime>	Restrict your search results to a specific time window, starting with the earliestTime. Specify "rt" to enable real-time searches.
<latestTime>Splunk time format</latestTime>	Restrict your search results to a specific time window, ending with the latestTime. Specify "rt" to enable real-time searches.

Example

Here's an example of a table panel with three general options and two panel specific options.

. . .
<table>
    <title>Look here for errors that you need to care about</title>
    <searchName>Errors in the last 24 hours</searchName>
    <fields>host, source, errorNumber</fields>
    <option name="count">25</option>
    <option name="displayRowNumbers">true</option>
</table>
. . .

Table panel

The table panel displays search data as a table. Use the <searchName> tag to specify which saved search results to display as a table. Use other general options as specified above.

Options for table panels

Tag	Description
<option name="count">integer</option>	The maximum number of rows to display.
<option name="displayRowNumbers">(true|false)</option>	Toggle display of row numbers to the left of results.
<option name="showPager">(true|false)</option>	Show paging in the table.

Example

Here's an example of a table panel specifying 25 rows and displaying the row numbers.

. . .
  <table>
    <title>Look here for errors that you need to care about</title>
    <searchName>Errors in the last 24 hours</searchName>
    <option name="count">25</option>
    <option name="displayRowNumbers">true</option>
 </table>
. . .

Chart panel

The chart panel displays search data in chart format. Pair the chart panel with a saved report you've already created. Saved reports contain chart formatting parameters. Saved searches, on the other hand, do not. For more information, see "Save reports and share them with others" in the User manual.

When you load a saved report in the chart panel, your saved report format is also loaded. However, chart formatting can be overridden inline using the chart options.

Charts use named options to specify chart-specific properties. The table below lists a few of these options. See the Custom Charting Configuration Reference in this Manual for details on specifying chart options.

Options for chart panels

Tag	Description
<option name="charting.chart">(bar|line|column|area|pie|scatter|bubble)</option>	Set the chart type.
<option name="charting.legend.placement">(top|left|bottom|right|none)</option>	Indicates the placement of the legend.
<option name="charting.chart.height">CSS dimension</option>	Set the height of the chart.
<option name="charting.*"></option>	All of the chart formatting options are supported here; see the custom charting configuration reference chapter in this Manual.

Example

This example shows a line chart panel for an inline search. It limits results to a specified time window, and provides labels for the X and Y axes.

. . .
<chart>
  <searchString>
     index=_internal metrics group="pipeline" NOT sendout 
     | head 1000 | timechart per_second(cpu_seconds) by processor
  </searchString>
  <earliestTime>-30h</earliestTime>
  <latestTime>-10h</latestTime>
  <option name="charting.chart">line</option>
  <option name="charting.primaryAxisTitle.text">Time</option>
  <option name="charting.secondaryAxisTitle.text">Load (%)</option>
</chart>
. . .

Event panel

The event panel displays the search results as individual events.

Options for event panels

Tag	Description
<option name="count">integer</option>	The maximum number of rows to display.
<option name="displayRowNumbers">(true|false)</option>	Toggle display of row numbers to the left of results.
<option name="entityName">(events|results)</option>	Toggle whether to show events or results. Events are individual events, while results are created by statistical operators. Defaults to results.
<option name="segmentation">(none|inner|outer|full)</option>	Set the segmentation of events displayed. This affects what you can and can't click on within the event.
<option name="maxLines">Integer</option>	The maximum number of lines to display for each result/event.
<option name="showPager">(true|false)</option>	Toggle pagination on or off.

Example

The following example shows an event panel specifying which fields to display, showing the pager, display 20 rows per page, and do not display row numbers.

. . .
<event>
  <title>Event view</title>
  <searchString>changelist | head 1000 | dedup changelist</searchString>
  <fields>added deleted changed</fields>
  <option name="showPager">true</option>
  <option name="count">20</option>
  <option name="displayRowNumbers">false</option>
</event>
. . .

Single value panel

The single value panel displays the result of a search that returns a single value. If you specify a search that returns multiple values, the single value panel displays the value from either the first row or first column of returned search data.

You can change the color of the panel by specifying a rangemap for the returned values.

Options for single value panels

Tag	Description
<additionalClass>CSS class name</additionalClass>	An optional additional css class name to add to the result container.
<linkView>view</linkView>	Specify which view to execute the linked search against. Defaults to dashboard.
<field>field</field>	Field to display. Defaults to first field returned.
<linkFields>(result|beforeLabel|afterLabel)</linkFields>	Set which part of the text in the single value to use as a link. To link the result and both labels, set as result,beforeLabel,afterLabel. Defaults to result
<classField>("class"|severe|elevated|low|None|)</classField>	Adds the value of the classField of the first result as an additional CSS class to the result container. Pre-defined classes include severe, elevated, low, and None. Default is None.
<beforeLabel>text</beforeLabel>	Label to display before the result.
<afterLabel>text</afterLabel>	Label to display after the result.
<linkSearch> search query</linkSearch>	Specify a valid complete search query to turn the result into a clickable link.

Example

The following example specifies a single value to display with a label after the value.

. . .
<single>
  <searchString>| metadata type="sources" | stats count</searchString>
  <option name="afterLabel">sources</option>
</single>

To change colors of the single results display, specify a range map in your search. Also, add range for the classField option.

<pre>
<single>
    <searchString>index=_internal 404 source="*web_access.log" earliest=-1h |
stats count | rangemap field=count low=0-0 elevated=1-100 default=severe</searchString>
      <title>404s this hour</title>
      <option name="classField">range</option>
</single>
. . .

HTML panel

The HTML panel displays inline HTML. The panel interpets the entire contents between the HTML tags literally, displayed HTML formatted text in the panel.

Any relative link references, such as images, are relative to the current view location. The HTML panel does not accept any options.

Example

. . .
<html>
    This lists all of the data you have loaded into 
    <strong>your</strong> default indexes over all time.
</html>
. . .

List panel

The list panel displays data in a list. Use this panel to display information from saved searches or search results. This panel supports the following options.

Required options for list

Tag	Description
<labelField>field name</labelField>	The field you want to use to generate labels for your list.
<valueField>field name</valueField>	The field you want to use to generate values for the labels in your list.

Optional options for list

Tag	Description
<initialSortDir>(asc|desc)</initialSortDir>	The direction to sort the results based on the initialSort field.
<labelFieldSearch>search string</labelFieldSearch>	The search string to generate when the user clicks on the label field. Requires labelFieldTarget to be defined to a valid view. The value of the label field is automatically added to the search.
<valueField></valueField>	Required. The name of the result field whose value should be displayed in the label part of the link list. Link lists are generally a combination of a descriptive label and a numeric count or other (value) field.
<labelFieldTarget></labelFieldTarget>	(Optional) The view to target if the label field is setup to generate a clickable link that dispatches a search.
<initialSort></initialSort>	(Optional) The field in the result set to sort on when the link list is first rendered.

Example

The following example shows a list panel listing the sourcetype for errors, followed by host name for the error:

. . .
<list>
  <searchName>Errors in the last 24 hours</searchName>
  <option name="labelField">sourcetype</option>
  <option name="valueField">host</option>
</list>
. . .