Panel reference for Simplified XML

Panel reference for Simplified XML

Use the panel reference when building simple dashboards or from searches from Splunk's Simplified XML. It lists configuration options for the various types of panels you can use, plus includes an example configuration for each.

There are general settings that can be applied to all panels. Different types of panels have specific configuration options.

General panel configuration

Options for all panels

Example

Here's an example of a table panel with three general options and two panel specific options.

. . .
<table>
    <title>Look here for errors that you need to care about</title>
    <searchName>Errors in the last 24 hours</searchName>
    <fields>host, source, errorNumber</fields>
    <option name="count">25</option>
    <option name="displayRowNumbers">true</option>
</table>
. . .

Table panel

The table panel displays search data as a table. Use the <searchName> tag to specify which saved search results to display as a table. Use other general options as specified above.

Options for table panels

Example

Here's an example of a table panel specifying 25 rows and displaying the row numbers.

. . .
  <table>
    <title>Look here for errors that you need to care about</title>
    <searchName>Errors in the last 24 hours</searchName>
    <option name="count">25</option>
    <option name="displayRowNumbers">true</option>
 </table>
. . .

Chart panel

The chart panel displays search data in chart format. Pair the chart panel with a saved report you've already created. Saved reports contain chart formatting parameters. Saved searches, on the other hand, do not. For more information, see "Save reports and share them with others" in the User manual.

When you load a saved report in the chart panel, your saved report format is also loaded. However, chart formatting can be overridden inline using the chart options.

Charts use named options to specify chart-specific properties. The table below lists a few of these options. See the Custom Charting Configuration Reference in this Manual for details on specifying chart options.

Options for chart panels

Example

This example shows a line chart panel for an inline search. It limits results to a specified time window, and provides labels for the X and Y axes.

. . .
<chart>
  <searchString>
     index=_internal metrics group="pipeline" NOT sendout 
     | head 1000 | timechart per_second(cpu_seconds) by processor
  </searchString>
  <earliestTime>-30h</earliestTime>
  <latestTime>-10h</latestTime>
  <option name="charting.chart">line</option>
  <option name="charting.primaryAxisTitle.text">Time</option>
  <option name="charting.secondaryAxisTitle.text">Load (%)</option>
</chart>
. . .

Event panel

The event panel displays the search results as individual events.

Options for event panels

Example

The following example shows an event panel specifying which fields to display, showing the pager, display 20 rows per page, and do not display row numbers.

. . .
<event>
  <title>Event view</title>
  <searchString>changelist | head 1000 | dedup changelist</searchString>
  <fields>added deleted changed</fields>
  <option name="showPager">true</option>
  <option name="count">20</option>
  <option name="displayRowNumbers">false</option>
</event>
. . .

Single value panel

The single value panel displays the result of a search that returns a single value. If you specify a search that returns multiple values, the single value panel displays the value from either the first row or first column of returned search data.

You can change the color of the panel by specifying a rangemap for the returned values.

Options for single value panels

Example

The following example specifies a single value to display with a label after the value.

. . .
<single>
  <searchString>| metadata type="sources" | stats count</searchString>
  <option name="afterLabel">sources</option>
</single>

To change colors of the single results display, specify a range map in your search. Also, add range for the classField option.

<pre>
<single>
    <searchString>index=_internal 404 source="*web_access.log" earliest=-1h |
stats count | rangemap field=count low=0-0 elevated=1-100 default=severe</searchString>
      <title>404s this hour</title>
      <option name="classField">range</option>
</single>
. . .

HTML panel

The HTML panel displays inline HTML. The panel interpets the entire contents between the HTML tags literally, displayed HTML formatted text in the panel.

Any relative link references, such as images, are relative to the current view location. The HTML panel does not accept any options.

Example

. . .
<html>
    This lists all of the data you have loaded into 
    <strong>your</strong> default indexes over all time.
</html>
. . .

List panel

The list panel displays data in a list. Use this panel to display information from saved searches or search results. This panel supports the following options.

Required options for list

Optional options for list

Example

The following example shows a list panel listing the sourcetype for errors, followed by host name for the error:

. . .
<list>
  <searchName>Errors in the last 24 hours</searchName>
  <option name="labelField">sourcetype</option>
  <option name="valueField">host</option>
</list>
. . .

• Was this topic useful?
• Post a comment