Dashboards & Visualizations

Force query result to display as chart

travis_bear
Explorer

I have the following query in Splunk 5:

index=summary
report=hw_use_by_jobs 
orig_host="my_host" |
chart 
   p50(PercentProcessorTime_max) as "p50 CPU", 
   stdev(PercentProcessorTime_max) as "CPU stdev",
   count as DataPoints
   over ConcurrentTasks |
eventstats sum(DataPoints) as Total_DataPoints  |
eval "Percent of Time"=100*DataPoints/Total_DataPoints | 
fields "ConcurrentTasks" "Percent of Time"  "p50 CPU"

The output of this query is a table of numeric data, with a UI option I can click to display the results as a graphical chart. Is there any way I can specify in the query itself that I want the data to display initially as a chart instead of as a table?

My goal is to stick this chart into a view, so if there is a better approach to doing this in the query itself, I'm open to that as well.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table). Simple xml example"-

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>IndexStats</label>
 <!-- Place panels within rows -->
  <row>
    <table>
      <title>Top Sourcetypes (Last 24 hours)</title>
      <!-- A search powers the panel -->
      <searchString>
       ****You search query****
      </searchString>

      <!-- Specify a time range for the search -->
      <earliestTime>-24h@h</earliestTime>
      <latestTime>now</latestTime>

      <!-- Use options to further define how to display result data -->
      <option name="wrap">true</option>
      <option name="rowNumbers">true</option>
    </table>
  </row>
  <row>
    <chart>
      <title>PerIndexThruputChart</title>
       <searchString>
       ****You search query****
      </searchString>
  <!-- Specify a time range for the search -->
  <earliestTime>-24h@h</earliestTime>
  <latestTime>now</latestTime>

  <!-- Use options to further define how to display result data -->
  <option name="charting.chart">bar</option>
</chart>


View solution in original post

somesoni2
Revered Legend

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table). Simple xml example"-

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>IndexStats</label>
 <!-- Place panels within rows -->
  <row>
    <table>
      <title>Top Sourcetypes (Last 24 hours)</title>
      <!-- A search powers the panel -->
      <searchString>
       ****You search query****
      </searchString>

      <!-- Specify a time range for the search -->
      <earliestTime>-24h@h</earliestTime>
      <latestTime>now</latestTime>

      <!-- Use options to further define how to display result data -->
      <option name="wrap">true</option>
      <option name="rowNumbers">true</option>
    </table>
  </row>
  <row>
    <chart>
      <title>PerIndexThruputChart</title>
       <searchString>
       ****You search query****
      </searchString>
  <!-- Specify a time range for the search -->
  <earliestTime>-24h@h</earliestTime>
  <latestTime>now</latestTime>

  <!-- Use options to further define how to display result data -->
  <option name="charting.chart">bar</option>
</chart>


travis_bear
Explorer

Thank you that was helpful!

0 Karma

travis_bear
Explorer

@somesoni -- That's helpful. If you submit your comment as an answer, I will accept it. If you include a simple xml example, I will upvote it as well.

0 Karma

somesoni2
Revered Legend

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table).

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...