Splunk® Enterprise

Developing Views and Apps for Splunk Web

Acrobat logo Download manual as PDF


Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Switcher modules

Important notice: The Advanced XML dashboard framework is officially deprecated. For more information, see Advanced XML Deprecation.

Switchers are useful for creating navigation within a view. You can use tabs or pulldown menus to switch between content. Switchers create a fork between different branches of XML, but the choice doesn't influence any individual search in the child branches. This is similar to lister modules, but lister modules allow for input that affects the searches in the child branches.

The Switcher modules that are most useful are:

  • PulldownSwitcher
  • TabSwitcher
  • LinkSwitcher

Here is an example using LinkSwitcher. There are more examples in the Dashboard Examples app, available from Splunkbase.

Add chrome

First add the chrome and nav for your page:

<view template="dashboard.html">
  <label>Switcher Intro</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  
  <module name="AppBar" layoutPanel="navigationHeader"/>
  
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>
   . . .
</view>

The group attributes can be confusing – sometimes they populate the dashboard panel titles, as in the module immediately below. But in the immediate child modules of switcher modules, the group attributes become the relevant label for the switcher element. For example, the tab's or pulldown option's text.

LinkSwitcher

This is a basic example using a LinkSwitcher with four children. All children use chart patterns.

Module Description
HiddenSearch Specifies a search to drive the chart.
HiddenChartFormatter Specifies custom charting configurations.
JobProgressIndicator (Optional) Displays the amount of chart remaining to load.
FlashChart Displays the actual Flash chart.

The last child adds a TimeRangePicker to drive the time of results.

. . .
<module name="LinkSwitcher" layoutPanel="panel_row2_col1">
  <param name="mode">independent</param>
  <param name="label"> </param>
. . .

First switcher child

The group attribute set on HiddenSearch governs the label that represents this branch in the switcher. For LinkSwitcher the label displays as a link.

. . .
<module name="HiddenSearch" group="cpu time by processor" autoRun="True">
  <param name="search">
    index="_internal" source="*metrics.log" group="pipeline" 
    | chart sum(cpu_seconds) over processor 
    | sort -sum(cpu_seconds) | head 10
  </param>

    <module name="HiddenChartFormatter">
      <param name="chart">line</param>
      <param name="primaryAxisTitle.text">CPU seconds</param>
      <param name="secondaryAxisTitle.text">Pipeline processors</param>
      <param name="legend.placement">right</param>
      
        <module name="JobProgressIndicator"/>
        
        <module name="FlashChart">
          <param name="width">100%</param>
          <param name="height">300px</param>
        </module>
        
    </module>
</module>
. . .

Second switcher child

. . .
<module name="HiddenSearch" group="KB Indexed by sourcetype" autoRun="True">
  <param name="search">
    index=_internal source=*metrics.log
    component=metrics group=per_sourcetype_thruput
    | chart sum(kb) by series | sort -sum(kb)
    | head 10
  </param>
  <param name="earliest">-1h</param>
  
    <module name="HiddenChartFormatter">
       <param name="chart">bar</param>
       <param name="primaryAxisTitle.text">Sourcetype</param>
       <param name="secondaryAxisTitle.text">KB Indexed</param>
       <param name="legend.placement">none</param>
       
         <module name="JobProgressIndicator"/>
         
         <module name="FlashChart">
           <param name="width">100%</param>
           <param name="height">300px</param>
         </module>
         
     </module>
</module>
. . .

Third switcher child

. . .
<module name="HiddenSearch" group="eps Indexed over time" autoRun="True">
  <param name="search">
    index=_internal source=*metrics.log
    component=metrics group=per_sourcetype_thruput
    | timechart avg(eps) by series
  </param>
  <param name="earliest">-1h</param>
  
    <module name="StaticContentSample">
      <param name="text">
        Some static text to describe the elements.
      </param>
    </module>
    
    <module name="HiddenChartFormatter">
      <param name="chart">line</param>
      <param name="primaryAxisTitle.text">Sourcetype</param>
      <param name="secondaryAxisTitle.text">events per second</param>
      <param name="legend.placement">right</param>
      
        <module name="JobProgressIndicator"/>
        
        <module name="FlashChart">
          <param name="width">100%</param>
          <param name="height">300px</param>
        </module>
        
     </module>
</module>
. . .

Fourth switcher child

This pattern uses HiddenSearch driven by a TimeRangePicker. Even though autoRun is set, (autoRun=true), the search does not run until given user input.

<module name="TimeRangePicker" group="Bucket Distribution">
  <param name="searchWhenChanged">True</param>
  <param name="selected">All time</param>
  
    <module name="HiddenSearch" autoRun="True">
      <param name="search">| dbinspect bins=400</param>
      
        <module name="HiddenChartFormatter">
          <param name="chart">line</param>
          <param name="primaryAxisTitle.text">Time</param>
          <param name="chartTitle">Distribution of index buckets over time</param>
          
            <module name="JobProgressIndicator"/>
            
            <module name="FlashChart"/>
            
        </module>
     </module>
</module>
Last modified on 13 August, 2019
PREVIOUS
Turn off autopause
  NEXT
Use lookups with a view

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters