I want to create a dashboard where I can change the 'SessionId' in the following query, ideally I want to be able to select one from a dropdown list and the chart would refresh.
host="jedi-sit2" SessionId=7e88e1f8-f06c-4950-bedc-97b2ad51d0e6 | timechart mode(ui_process_memory)
Is this possible?
You can achieve this through simple xml forms. Here's an example of what it might look like, where there is a dropdown of available session ids that is populated by a Splunk search.
For more information/examples on forms, here's a link to the docs:
<form> <label>session_id_search</label> <fieldset> <input type="dropdown" token="session_id"> <label>Session ID:</label> <populatingSearch fieldForValue="SessionID" fieldForLabel="SessionID" earliest="-7d@d" latest="now">host="jedi-sit2" | dedup SessionID</populatingSearch> </input> </fieldset> <row> <chart> <searchString>host="jedi-sit2" SessionId="$session_id$" | timechart mode(ui_process_memory)</searchString> <title>Memory Usage</title> <option name="charting.chart">line</option> <earliestTime>-7d@d</earliestTime> <latestTime>now</latestTime> </chart> </row> </form>
How to round decimal places? 4 Answers
Split chart based on time 0 Answers