Dashboards & Visualizations

Populate Dashboard/View with Panels/Graphs based on Search (Dynamic Dashboard)

jeffa
Path Finder

Is it possible to dynamically populate a dashboard/view with panels/charts based on search results? For example, I track disk utilization across my systems w/ Splunk, and I'd like to be able to create a dashboard of disk utilization graphs only for disks whose utilization has changed by a specified amount. In other words, of our 100+ disks, only 10 or so will have changed utilization over the last week, but the set of changed disks will not be the same from day to day.

So, I want one panel/chart per disk (with a few items for that disk charted). The number of disks, as well as which disks should be charted would be dynamic. So, if I have 5 servers w/ C: drives, and only servers 1 and 4 have significant change in the last week, I want the view/dashboard to display two graphs/panels, one for the disk on server 1, and one for the disk on server 4. If the next week, servers 3-5 have disks w/ significant change, I want the view/dashboard to display three graphs/panels, one for server3, one for server4, one for server5

acdevlin
Communicator

Absolutely! Check out the following app for some examples and ideas: http://splunk-base.splunk.com/apps/22333/splunk-ui-examples-app-for-41

The source code for all examples can be found in the Manager. You should be able to do what you want using simplified xml; I'd strongly recommend looking at the "Form Search Intro" section, since I believe it is most relevant to what you're looking for.

You could also check out the documentation about putting a chart in a dashboard: http://docs.splunk.com/Documentation/Splunk/latest/Developer/AddAChart

0 Karma

jeffa
Path Finder

Multiple panels are a key requirement. Ultimately I want to email this dashboard as a PDF, so no user interaction will be possible for that.

0 Karma

acdevlin
Communicator

I can think of one potential alternative, though. What if you set up a dashboard to:

1) Search for the disks which changed in the last week

2) Dynamically populate a dropdown menu based on the disks returned from step 1

3) Use the disk selected from the dropdown to populate a single panel containing the data you want to see.

Would this work for your current project, or are multiple panels a key requirement?

0 Karma

acdevlin
Communicator

Ah, I did misunderstand you a bit earlier...my mistake!

This old answer seems to have something relevant, though I have not tried this myself: http://splunk-base.splunk.com/answers/11813/how-to-dynamically-generate-a-dashboard-in-which-the-of-...

It, unfortunately, seems rather complicated...

0 Karma

jeffa
Path Finder

Thanks for the suggestion on the ui examples app. I may be missing something, but I don't see what I'm looking for in those examples. I may need to be wording this better, but what I want to do is populate a dashboard with a dynamically generated set of panels. The number of panels (changed disks) and set of changed disks will be different from day to day.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...