Dashboards & Visualizations

Dashboard dynamic pulldown that populates five grouped pie charts in Splunk 4.3

eandresen
Path Finder

Hello All,

I am working on a new dashboard panel that has five grouped pie charts within the single panel. It is my hope to have a dynamic pull-down that is populated with a set of project names returned by a search string. When one of the project names is selected, it would be used in five separate saved searches that provide the data for the pie charts.

I have spent the last couple of hours searching through Splunk Answers and Google and I have a working dashboard panel with the five pie charts in it. However, I still cannot seem to figure out the dynamic pull-down and updating of the search strings with the select value. Instead of me continuing to bang my head on the desk, I was hoping that somebody on Splunk Answers could provide me a hand in completing my work.

Instead of wasting everybody’s time with telling you what I have attempted so far and what has not worked, I thought it would be easier to show you what I have completed thus far and someone that is better with creating dashboards can fill in the blanks for me.

Dashboard Code:

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
  <label>TEST</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="DashboardTitleBar" layoutPanel="viewHeader"/>
  <module name="Message" layoutPanel="navigationHeader">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
    <param name="level">warn</param>
  </module>
  <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp1" group="Scalr Quota by OU - Havana" autoRun="True">
    <param name="savedSearch">Scalr Quota by OU - Cores - Havana</param>
    <param name="groupLabel">Scalr Quota by OU - Cores - Havana</param>
    <module name="GenericHeader">
      <param name="label">
        Cores
      </param>
        <module name="ViewstateAdapter">
        <param name="suppressionList">
          <item>charting.chart</item>
        </param>
        <param name="savedSearch">Scalr Quota by OU - Cores - Havana</param>
        <module name="HiddenFieldPicker">
          <param name="strictMode">True</param>
          <module name="JobProgressIndicator">
            <module name="EnablePreview">
              <param name="enable">True</param>
              <param name="display">False</param>
              <module name="HiddenChartFormatter">
                <param name="charting.chart">pie</param>
                <module name="JSChart">
                  <param name="width">100%</param>
                  <module name="Gimp"/>
                  <module name="ConvertToDrilldownSearch">
                    <module name="ViewRedirector">
                      <param name="viewTarget">flashtimeline</param>
                    </module>
                  </module>
                </module>
                <module name="ViewRedirectorLink">
                  <param name="viewTarget">flashtimeline</param>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
  <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp2" group="Scalr Quota by OU - Gigabytes - Havana" autoRun="True">
    <param name="savedSearch">Scalr Quota by OU - Gigabytes - Havana</param>
    <param name="groupLabel">Scalr Quota by OU - Gigabytes - Havana</param>
    <module name="GenericHeader">
      <param name="label">
        Gigabytes
      </param>
        <module name="ViewstateAdapter">
        <param name="suppressionList">
          <item>charting.chart</item>
        </param>
        <param name="savedSearch">Scalr Quota by OU - Gigabytes - Havana</param>
        <module name="HiddenFieldPicker">
          <param name="strictMode">True</param>
          <module name="JobProgressIndicator">
            <module name="EnablePreview">
              <param name="enable">True</param>
              <param name="display">False</param>
              <module name="HiddenChartFormatter">
                <param name="charting.chart">pie</param>
                <module name="JSChart">
                  <param name="width">100%</param>
                  <module name="Gimp"/>
                  <module name="ConvertToDrilldownSearch">
                    <module name="ViewRedirector">
                      <param name="viewTarget">flashtimeline</param>
                    </module>
                  </module>
                </module>
                <module name="ViewRedirectorLink">
                  <param name="viewTarget">flashtimeline</param>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
  <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp3" group="Scalr Quota by OU - Instances - Havana" autoRun="True">
    <param name="savedSearch">Scalr Quota by OU - Instances - Havana</param>
    <param name="groupLabel">Scalr Quota by OU - Instances - Havana</param>
    <module name="GenericHeader">
      <param name="label">
        Instances
      </param>
        <module name="ViewstateAdapter">
        <param name="suppressionList">
          <item>charting.chart</item>
        </param>
        <param name="savedSearch">Scalr Quota by OU - Instances - Havana</param>
        <module name="HiddenFieldPicker">
          <param name="strictMode">True</param>
          <module name="JobProgressIndicator">
            <module name="EnablePreview">
              <param name="enable">True</param>
              <param name="display">False</param>
              <module name="HiddenChartFormatter">
                <param name="charting.chart">pie</param>
                <module name="JSChart">
                  <param name="width">100%</param>
                  <module name="Gimp"/>
                  <module name="ConvertToDrilldownSearch">
                    <module name="ViewRedirector">
                      <param name="viewTarget">flashtimeline</param>
                    </module>
                  </module>
                </module>
                <module name="ViewRedirectorLink">
                  <param name="viewTarget">flashtimeline</param>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
  <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp4" group="Scalr Quota by OU - Ram - Havana" autoRun="True">
    <param name="savedSearch">Scalr Quota by OU - Ram - Havana</param>
    <param name="groupLabel">Scalr Quota by OU - Ram - Havana</param>
    <module name="GenericHeader">
      <param name="label">
        Ram
      </param>
        <module name="ViewstateAdapter">
        <param name="suppressionList">
          <item>charting.chart</item>
        </param>
        <param name="savedSearch">Scalr Quota by OU - Ram - Havana</param>
        <module name="HiddenFieldPicker">
          <param name="strictMode">True</param>
          <module name="JobProgressIndicator">
            <module name="EnablePreview">
              <param name="enable">True</param>
              <param name="display">False</param>
              <module name="HiddenChartFormatter">
                <param name="charting.chart">pie</param>
                <module name="JSChart">
                  <param name="width">100%</param>
                  <module name="Gimp"/>
                  <module name="ConvertToDrilldownSearch">
                    <module name="ViewRedirector">
                      <param name="viewTarget">flashtimeline</param>
                    </module>
                  </module>
                </module>
                <module name="ViewRedirectorLink">
                  <param name="viewTarget">flashtimeline</param>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>  
  <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp5" group="Scalr Quota by OU - Volumes - Havana" autoRun="True">
    <param name="savedSearch">Scalr Quota by OU - Volumes - Havana</param>
    <param name="groupLabel">Scalr Quota by OU - Volumes - Havana</param>
    <module name="GenericHeader">
      <param name="label">
        Volumes
      </param>
        <module name="ViewstateAdapter">
        <param name="suppressionList">
          <item>charting.chart</item>
        </param>
        <param name="savedSearch">Scalr Quota by OU - Volumes - Havana</param>
        <module name="HiddenFieldPicker">
          <param name="strictMode">True</param>
          <module name="JobProgressIndicator">
            <module name="EnablePreview">
              <param name="enable">True</param>
              <param name="display">False</param>
              <module name="HiddenChartFormatter">
                <param name="charting.chart">pie</param>
                <module name="JSChart">
                  <param name="width">100%</param>
                  <module name="Gimp"/>
                  <module name="ConvertToDrilldownSearch">
                    <module name="ViewRedirector">
                      <param name="viewTarget">flashtimeline</param>
                    </module>
                  </module>
                </module>
                <module name="ViewRedirectorLink">
                  <param name="viewTarget">flashtimeline</param>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>  
</view>

Saved Searches:

Project names - index=app sourcetype=ecos_reports source="/var/log/ecos/quota_ost_havana.log" project_name=* earliest=-1h@h latest=@h | stats count by project_name

Scalr Quota by OU - Cores - Havana - index=app sourcetype=ecos_reports source="/var/log/ecos/quota_ost_havana.log" project_name=GIS resource=cores earliest=-1h@h latest=@h | stats sum(usage) as Usage values(quota) as Quota | transpose

Scalr Quota by OU - Gigabytes - Havana - index=app sourcetype=ecos_reports source="/var/log/ecos/quota_ost_havana.log" project_name=GIS resource=gigabytes earliest=-1h@h latest=@h | stats sum(usage) as Usage values(quota) as Quota | transpose

Scalr Quota by OU - Instances - Havana - index=app sourcetype=ecos_reports source="/var/log/ecos/quota_ost_havana.log" project_name=GIS resource=instances earliest=-1h@h latest=@h | stats sum(usage) as Usage values(quota) as Quota | transpose

Scalr Quota by OU - Ram - Havana - index=app sourcetype=ecos_reports source="/var/log/ecos/quota_ost_havana.log" project_name=GIS resource=ram earliest=-1h@h latest=@h | stats sum(usage) as Usage values(quota) as Quota | transpose

Scalr Quota by OU - Volumes - Havana - index=app sourcetype=ecos_reports source="/var/log/ecos/quota_ost_havana.log" project_name=GIS resource=volumes earliest=-1h@h latest=@h | stats sum(usage) as Usage values(quota) as Quota | transpose

Thanks in advanced for the help!

Erik

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this (runanywhere example with dropdown for sourcetype and two panels)

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">
  <label>SimpleXmlDropDown</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>
  <module name="SearchSelectLister" layoutPanel="viewHeader">
    <param name="settingToCreate">sourcetype_setting</param>
    <param name="label">Select Name</param>
    <param name="search">index=_internal earliest=-1h@h | stats count by sourcetype
        </param>
    <param name="staticFieldsToDisplay"/>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">sourcetype</param>
        <param name="label">sourcetype</param>
      </list>
    </param>
    <param name="searchWhenChanged">False</param>
    <module name="ConvertToIntention">
      <param name="intention">
        <param name="arg">
          <param name="sourcetype">
            <param name="value">$target$</param>
            <param name="fillOnEmpty">True</param>
          </param>
        </param>
        <param name="name">stringreplace</param>
      </param>
      <param name="settingToConvert">sourcetype_setting</param>
      <module name="SubmitButton" layoutPanel="viewHeader">
        <param name="allowSoftSubmit">True</param>
        <param name="visible">True</param>
        <param name="label">Search</param>
        <param name="updatePermalink">True</param>
        <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Count over time" autoRun="False">
          <param name="groupLabel">Count over time</param>
          <param name="search">
        index=_internal sourcetype=$sourcetype$ earliest=-1h@h| timechart count
      </param>
          <module name="ViewstateAdapter">
            <param name="suppressionList">
              <item>charting.chart</item>
            </param>
            <module name="HiddenFieldPicker">
              <param name="strictMode">True</param>
              <module name="JobProgressIndicator">
                <module name="EnablePreview">
                  <param name="enable">True</param>
                  <param name="display">False</param>
                  <module name="HiddenChartFormatter">
                    <param name="charting.chart">area</param>
                    <module name="JSChart">
                      <param name="width">100%</param>
                      <module name="Gimp"/>
                      <module name="ConvertToDrilldownSearch">
                        <module name="ViewRedirector">
                          <param name="viewTarget">flashtimeline</param>
                        </module>
                      </module>
                    </module>
                    <module name="ViewRedirectorLink">
                      <param name="viewTarget">flashtimeline</param>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
        <module name="HiddenSearch" layoutPanel="panel_row1_col2" group="Top sources in sourcetype" autoRun="False">
          <param name="groupLabel">Top sources in sourcetype</param>
          <param name="search">
        index=_internal sourcetype=$sourcetype$ earliest=-1h@h| top source
     </param>
          <module name="ViewstateAdapter">
            <param name="suppressionList"/>
            <module name="HiddenFieldPicker">
              <param name="strictMode">True</param>
              <module name="JobProgressIndicator"/>
              <module name="Paginator">
                <param name="count">10</param>
                <param name="entityName">results</param>
                <module name="EnablePreview">
                  <param name="enable">True</param>
                  <param name="display">False</param>
                  <module name="SimpleResultsTable">
                    <param name="drilldown">row</param>
                    <param name="allowTransformedFieldSelect">True</param>
                    <param name="entityName">results</param>
                    <module name="Gimp"/>
                    <module name="ConvertToDrilldownSearch">
                      <module name="ViewRedirector">
                        <param name="viewTarget">flashtimeline</param>
                      </module>
                    </module>
                  </module>
                  <module name="ViewRedirectorLink">
                    <param name="viewTarget">flashtimeline</param>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>

View solution in original post

0 Karma

eandresen
Path Finder

Yep, we are working on the project now to complete the upgrade process, which also involves new hardware. We decided to skip over Splunk 5.0 and 6.0 and that is why we are still running Splunk 4.3 and planning to go all the way up to Splunk 6.1.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this (runanywhere example with dropdown for sourcetype and two panels)

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">
  <label>SimpleXmlDropDown</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>
  <module name="SearchSelectLister" layoutPanel="viewHeader">
    <param name="settingToCreate">sourcetype_setting</param>
    <param name="label">Select Name</param>
    <param name="search">index=_internal earliest=-1h@h | stats count by sourcetype
        </param>
    <param name="staticFieldsToDisplay"/>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">sourcetype</param>
        <param name="label">sourcetype</param>
      </list>
    </param>
    <param name="searchWhenChanged">False</param>
    <module name="ConvertToIntention">
      <param name="intention">
        <param name="arg">
          <param name="sourcetype">
            <param name="value">$target$</param>
            <param name="fillOnEmpty">True</param>
          </param>
        </param>
        <param name="name">stringreplace</param>
      </param>
      <param name="settingToConvert">sourcetype_setting</param>
      <module name="SubmitButton" layoutPanel="viewHeader">
        <param name="allowSoftSubmit">True</param>
        <param name="visible">True</param>
        <param name="label">Search</param>
        <param name="updatePermalink">True</param>
        <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Count over time" autoRun="False">
          <param name="groupLabel">Count over time</param>
          <param name="search">
        index=_internal sourcetype=$sourcetype$ earliest=-1h@h| timechart count
      </param>
          <module name="ViewstateAdapter">
            <param name="suppressionList">
              <item>charting.chart</item>
            </param>
            <module name="HiddenFieldPicker">
              <param name="strictMode">True</param>
              <module name="JobProgressIndicator">
                <module name="EnablePreview">
                  <param name="enable">True</param>
                  <param name="display">False</param>
                  <module name="HiddenChartFormatter">
                    <param name="charting.chart">area</param>
                    <module name="JSChart">
                      <param name="width">100%</param>
                      <module name="Gimp"/>
                      <module name="ConvertToDrilldownSearch">
                        <module name="ViewRedirector">
                          <param name="viewTarget">flashtimeline</param>
                        </module>
                      </module>
                    </module>
                    <module name="ViewRedirectorLink">
                      <param name="viewTarget">flashtimeline</param>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
        <module name="HiddenSearch" layoutPanel="panel_row1_col2" group="Top sources in sourcetype" autoRun="False">
          <param name="groupLabel">Top sources in sourcetype</param>
          <param name="search">
        index=_internal sourcetype=$sourcetype$ earliest=-1h@h| top source
     </param>
          <module name="ViewstateAdapter">
            <param name="suppressionList"/>
            <module name="HiddenFieldPicker">
              <param name="strictMode">True</param>
              <module name="JobProgressIndicator"/>
              <module name="Paginator">
                <param name="count">10</param>
                <param name="entityName">results</param>
                <module name="EnablePreview">
                  <param name="enable">True</param>
                  <param name="display">False</param>
                  <module name="SimpleResultsTable">
                    <param name="drilldown">row</param>
                    <param name="allowTransformedFieldSelect">True</param>
                    <param name="entityName">results</param>
                    <module name="Gimp"/>
                    <module name="ConvertToDrilldownSearch">
                      <module name="ViewRedirector">
                        <param name="viewTarget">flashtimeline</param>
                      </module>
                    </module>
                  </module>
                  <module name="ViewRedirectorLink">
                    <param name="viewTarget">flashtimeline</param>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Still, even (especially?) in large environments you should get the time invested in an upgrade back quickly.

Do you have Sideview Utils on your Splunk(s)?

0 Karma

eandresen
Path Finder

That is not as easiest as it sounds for us as we have over 200 Splunk servers in 13 separate instances. It is not as simple as dropping a rpm onto a server and running it.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You should really consider upgrading to Splunk 6.1. This kind of thing can now be built using the graphical SimpleXML editor in no time.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...