Splunk Search

Multicharts on dashboard

minkyuk
Explorer

Hello-

Right now I'm trying to figure out how I could put multicharts on dashboard if I have two objects given:
A list of host (1 column), and a script that takes in the name of one host and make a chart out of it.

If I were to loop through the process of putting every host in a list through the script and chart it out and put them on dashboard,
How could I accomplish this in a wiser way than to hardcode it? (50+ hosts in a list)

Thank you for your time,
Jack

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

This should be achievable in JS/HTML dashboards. Basically, run your Python script in an invisible SearchManager, listen to its search:done event, read results, loop over results creating SearchManager objects and their associated charts using your hosts.

This might not be terribly efficient, launching 50 searches for 50 hosts. It'd be better to run one search with a list of those 50 hosts and then pick the results apart for display - depends on too many variables whether this is feasible or not.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

This should be achievable in JS/HTML dashboards. Basically, run your Python script in an invisible SearchManager, listen to its search:done event, read results, loop over results creating SearchManager objects and their associated charts using your hosts.

This might not be terribly efficient, launching 50 searches for 50 hosts. It'd be better to run one search with a list of those 50 hosts and then pick the results apart for display - depends on too many variables whether this is feasible or not.

0 Karma

jeremiahc4
Builder

I'm not seeing enough details to make a solid recommendation on what your trying to do, but in general you can chart by some value such as this which will place multiple lines on the chart;

<search terms> | chart count by value

Your "value" in this case sounds like it is your hosts, but I don't see what metric you are trying to display per host. There are many functions you could put in there, for instance "avg(cpu)" or "max(time_taken)". I just don't see what you are measuring.

Ref: http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Chart

0 Karma

minkyuk
Explorer

Hello, sorry for the lack of details.
I meant to say that I need an individual chart for every host. And for each host, the information is extracted by a python script which I timechart it.
So, I want a dashboard of 50 individual charts.. each one for different host.

but I only have a list of hosts and a python script. For example,

| lp_py disk HOSTNAME | timechart used_mb

would give me a single chart for a host.

But If I were to repeat this for every host on the list I have, I can't think of any other methods than to hardcode.

Do you have any idea?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...