advanced* interac=ons*with* simple*xml* · simple*xml*has*come*along*way* 6 splunk 6.1 • form...
TRANSCRIPT
![Page 1: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/1.jpg)
Copyright © 2015 Splunk Inc.
Mathew El=ng Siegfried Puchbauer
Advanced Interac=ons with Simple XML
![Page 2: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/2.jpg)
Disclaimer
2
During the course of this presenta=on, we may make forward looking statements regarding future events or the expected performance of the company. We cau=on you that such statements reflect our current expecta=ons and es=mates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-‐looking statements, please review our filings with the SEC. The forward-‐looking statements made in the this presenta=on are being made as of the =me and date of its live presenta=on. If reviewed aRer its live presenta=on, this presenta=on may not contain current or
accurate informa=on. We do not assume any obliga=on to update any forward looking statements we may make.
In addi=on, any informa=on about our roadmap outlines our general product direc=on and is subject to change at any =me without no=ce. It is for informa=onal purposes only and shall not, be incorporated into any contract or other commitment. Splunk undertakes no obliga=on either to develop the features
or func=onality described or to include any such feature or func=onality in a future release.
![Page 3: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/3.jpg)
Agenda
! Background ! What’s new ! Live Example
– Tokens – Event Handlers – Show/Hide content – Search Events
! Wrap-‐Up
3
![Page 4: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/4.jpg)
Splunk Web Framework
4
Visual Editor Simple XML Custom HTML w/ Splunk JS Stack Advanced XML
Descrip@on
100% GUI Driven; drag-‐and-‐drop panels. Basic visual edi=ng
XML config driven; constrained, defined object model Internally supported
Full HTML support. Leverage library of JS components
XML config driven; unconstrained; internally/externally supported
When to Use
• PDF Prin=ng • Drag-‐and-‐Drop (full) • Form Inputs
• Dynamic/Contextual Drilldown
• Event Handlers • Addi=onal Layout/Display • Add op=ons / parameters • PDF Prin=ng • Drag-‐and-‐Drop (full) • JS/CSS Extensions
• Custom Layout • Custom Form Inputs • Addi=onal interac=vity • New Visualiza=ons • Custom Javascript
• Custom Layout • Custom Form Inputs • Addi=onal Interac=vity • New Visualiza=ons • Legacy support • Reusable modules
![Page 5: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/5.jpg)
Anatomy of a Dashboard
5
Title
Form Inputs (fieldset / inputs)
Row
Panel Panel
Element Element
Element
<form> <label>My Dashboard</label> <fieldset> <input> <!– form inputs --> </input> </fieldset> <row> <panel> <chart> <!– ... --> </chart> <table> <!– ... --> </table> </panel> </row> </form>
![Page 6: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/6.jpg)
Simple XML Has Come a Long Way
6
Splunk 6.1
• Form Inputs • Drilldown
Splunk 6.2
• Reusable Panels • Multi-Search Management
Splunk 6.3
• Search Events • Dashboard Eval Expressions • Link Switcher
![Page 7: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/7.jpg)
Let’s build some dashboards!
7
![Page 8: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/8.jpg)
The Data: Track Day
! Sonoma Raceways – 1 Day – 28 Splunkers – 30 Cars
! Data via – ODB II Dongle -‐> Cloud Service -‐> Modular Input – Loca=on data & metrics (speed, rpm, etc)
8
![Page 9: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/9.jpg)
Building Dashboards Part I
9
![Page 10: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/10.jpg)
Tokens
10
! Automa=c data binding ! Variables – connec=ng components and interac=ons ! Use in UI or XML
![Page 11: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/11.jpg)
Token Filters
! Insert altered/processed value ! Built-‐in – $token|s$ -‐ search escape – $token|u$ -‐ URL encode – $token|h$ -‐ HTML escape
! Build your own (in Javascript) – $token|myfilter$
11
![Page 12: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/12.jpg)
Form Input Values and Token Namespaces ! Token Namespaces
– default – current values of form input fields
– submiFed – submioed values of fields
– url – submioed form.* tokens persisted
Refer to namespaces: $submitted:driver$ !
12
! $form.mytoken$ !tokens contain raw form input
! $mytoken$ !aRer applying prefix, suffix, default value
![Page 13: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/13.jpg)
Building Dashboards Part II
13
![Page 14: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/14.jpg)
Event Handlers ! Introduce behaviors based on event hooks
ê User ini=ated events, or search job events
! Types ê drilldown – user clicks on a cell, or bar on a chart ê input / change – user selects a value on a form input ê selec=on – for line/column/area, user selects a window to zoom into ê search – events come back from a search job (progress, finalized, error)
! Configure Behaviors ê Set tokens ê Unset tokens ê Link to another page or search ê Evaluate new tokens
14
![Page 15: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/15.jpg)
Show and Hide Content
! Control whether you hide or show a given object based on existence of a token
ê Contextual (in-‐page) Drilldown ê Cascading Form Inputs
! Applies to element, row, panel, input objects ! Type
ê <table depends=“$show_table$”> !– Hide by default, show when token(s) exist
ê <table rejects=“$hide_table$”> !– Show by default, hide when token(s) exist
15
![Page 16: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/16.jpg)
Building Dashboards Part III
16
![Page 17: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/17.jpg)
Search & Result Token Seoer • Advanced Dashboard Logic
• Key Benefits ê Include result count in =tle ê Null search swapper (hide if search returns no results) ê Custom HTML element driven by search object
• Run search object anywhere on the page
• Set tokens within search based on ê Search metadata (string, earliest/latest) ê Job metadata (result count, run =me) ê 1st result
• Eval-‐based condi=on/value support
17
![Page 18: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/18.jpg)
Wrap-‐Up
![Page 19: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/19.jpg)
What’s New in 6.3
! Search Events – Use data from search job and search results in your dashboard
! Dashboard Eval Expressions – Powerful condi=onal statements – Evaluate new token values
! Link Switcher
19
![Page 20: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/20.jpg)
More Informa=on • Splunk 6.x Dashboard Examples
hops://splunkbase.splunk.com/app/1603/ • Documenta=on
hop://docs.splunk.com/…/6.3.0/Viz/OverviewofSimplifiedXML
![Page 21: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/21.jpg)
More Informa=on ! Demo Code
hops://github.com/splunk/advanced-‐dashboards-‐conf15 ! Splunk 6.x Dashboard Examples
hops://splunkbase.splunk.com/app/1603/ • Documenta=on
hop://docs.splunk.com/…/6.3.0/Viz/OverviewofSimplifiedXML
![Page 22: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/22.jpg)
Splunk 6.x Dashboard Examples App ! Recipe Book for Dashboards ! Updated on Every Release ! Examples
ê Basic ê Chart ê Table ê Single Value ê Map ê Search Types ê Form Input ê Drilldown ê Layout ê Custom Visualiza=ons ê Token Customiza=on
! Tools
22
![Page 23: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/23.jpg)
Come Visit – “Ask the Dashboard Expert”
23
! For assistance with troublesome dashboards ! For migra=on =ps ! To brag about something cool you built ! To ask ques=ons ! Or, just to say hi!
@Dashboard Clinic
![Page 24: Advanced* Interac=ons*with* Simple*XML* · Simple*XML*Has*Come*aLong*Way* 6 Splunk 6.1 • Form Inputs • Drilldown Splunk 6.2 • •Reusable Panels • Multi-Search Management](https://reader033.vdocuments.us/reader033/viewer/2022060209/5f0463e97e708231d40dbc9e/html5/thumbnails/24.jpg)
THANK YOU
</dashboard>