Switcher modules

Important notice: The Advanced XML dashboard framework is officially deprecated. For more information, see Advanced XML Deprecation.

Switchers are useful for creating navigation within a view. You can use tabs or pulldown menus to switch between content. Switchers create a fork between different branches of XML, but the choice doesn't influence any individual search in the child branches. This is similar to lister modules, but lister modules allow for input that affects the searches in the child branches.

The Switcher modules that are most useful are:

• PulldownSwitcher
• TabSwitcher
• LinkSwitcher

Here is an example using LinkSwitcher. There are more examples in the Dashboard Examples app, available from Splunkbase.

Add chrome

First add the chrome and nav for your page:

<view template="dashboard.html">
  <label>Switcher Intro</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  
  <module name="AppBar" layoutPanel="navigationHeader"/>
  
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>
   . . .
</view>

The group attributes can be confusing – sometimes they populate the dashboard panel titles, as in the module immediately below. But in the immediate child modules of switcher modules, the group attributes become the relevant label for the switcher element. For example, the tab's or pulldown option's text.

LinkSwitcher

This is a basic example using a LinkSwitcher with four children. All children use chart patterns.

Module	Description
HiddenSearch	Specifies a search to drive the chart.
HiddenChartFormatter	Specifies custom charting configurations.
JobProgressIndicator	(Optional) Displays the amount of chart remaining to load.
FlashChart	Displays the actual Flash chart.

The last child adds a TimeRangePicker to drive the time of results.

. . .
<module name="LinkSwitcher" layoutPanel="panel_row2_col1">
  <param name="mode">independent</param>
  <param name="label"> </param>
. . .

First switcher child

The group attribute set on HiddenSearch governs the label that represents this branch in the switcher. For LinkSwitcher the label displays as a link.

. . .
<module name="HiddenSearch" group="cpu time by processor" autoRun="True">
  <param name="search">
    index="_internal" source="*metrics.log" group="pipeline" 
    | chart sum(cpu_seconds) over processor 
    | sort -sum(cpu_seconds) | head 10
  </param>

    <module name="HiddenChartFormatter">
      <param name="chart">line</param>
      <param name="primaryAxisTitle.text">CPU seconds</param>
      <param name="secondaryAxisTitle.text">Pipeline processors</param>
      <param name="legend.placement">right</param>
      
        <module name="JobProgressIndicator"/>
        
        <module name="FlashChart">
          <param name="width">100%</param>
          <param name="height">300px</param>
        </module>
        
    </module>
</module>
. . .

Second switcher child

. . .
<module name="HiddenSearch" group="KB Indexed by sourcetype" autoRun="True">
  <param name="search">
    index=_internal source=*metrics.log
    component=metrics group=per_sourcetype_thruput
    | chart sum(kb) by series | sort -sum(kb)
    | head 10
  </param>
  <param name="earliest">-1h</param>
  
    <module name="HiddenChartFormatter">
       <param name="chart">bar</param>
       <param name="primaryAxisTitle.text">Sourcetype</param>
       <param name="secondaryAxisTitle.text">KB Indexed</param>
       <param name="legend.placement">none</param>
       
         <module name="JobProgressIndicator"/>
         
         <module name="FlashChart">
           <param name="width">100%</param>
           <param name="height">300px</param>
         </module>
         
     </module>
</module>
. . .

Third switcher child

. . .
<module name="HiddenSearch" group="eps Indexed over time" autoRun="True">
  <param name="search">
    index=_internal source=*metrics.log
    component=metrics group=per_sourcetype_thruput
    | timechart avg(eps) by series
  </param>
  <param name="earliest">-1h</param>
  
    <module name="StaticContentSample">
      <param name="text">
        Some static text to describe the elements.
      </param>
    </module>
    
    <module name="HiddenChartFormatter">
      <param name="chart">line</param>
      <param name="primaryAxisTitle.text">Sourcetype</param>
      <param name="secondaryAxisTitle.text">events per second</param>
      <param name="legend.placement">right</param>
      
        <module name="JobProgressIndicator"/>
        
        <module name="FlashChart">
          <param name="width">100%</param>
          <param name="height">300px</param>
        </module>
        
     </module>
</module>
. . .

Fourth switcher child

This pattern uses HiddenSearch driven by a TimeRangePicker. Even though autoRun is set, (autoRun=true), the search does not run until given user input.

<module name="TimeRangePicker" group="Bucket Distribution">
  <param name="searchWhenChanged">True</param>
  <param name="selected">All time</param>
  
    <module name="HiddenSearch" autoRun="True">
      <param name="search">| dbinspect bins=400</param>
      
        <module name="HiddenChartFormatter">
          <param name="chart">line</param>
          <param name="primaryAxisTitle.text">Time</param>
          <param name="chartTitle">Distribution of index buckets over time</param>
          
            <module name="JobProgressIndicator"/>
            
            <module name="FlashChart"/>
            
        </module>
     </module>
</module>