Implementing Splunk - Second Edition

Reusing a query

One example of separating layout from data would be using a single query to populate both a table and a chart.

The advanced XML for this could look like the following code:

<view template="dashboard.html"> <label>Chapter 9 - Reusing a query</label> <module name="StaticContentSample" layoutPanel="panel_row1_col1"> <param name="text">Text above</param> </module> <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True"> <param name="search"> sourcetype="impl_splunk_gen" loglevel=error | top user </param> <param name="earliest">-99d</param> <module name="HiddenChartFormatter"> <param name="charting.chart">pie</param> <module name="JSChart"></module> <module name="StaticContentSample" layoutPanel="panel_row1_col1"> <!-- ...