Dashboards & Visualizations

Populate Dashboard/View with Panels/Graphs based on Search (Dynamic Dashboard)

jeffa
Path Finder

Is it possible to dynamically populate a dashboard/view with panels/charts based on search results? For example, I track disk utilization across my systems w/ Splunk, and I'd like to be able to create a dashboard of disk utilization graphs only for disks whose utilization has changed by a specified amount. In other words, of our 100+ disks, only 10 or so will have changed utilization over the last week, but the set of changed disks will not be the same from day to day.

So, I want one panel/chart per disk (with a few items for that disk charted). The number of disks, as well as which disks should be charted would be dynamic. So, if I have 5 servers w/ C: drives, and only servers 1 and 4 have significant change in the last week, I want the view/dashboard to display two graphs/panels, one for the disk on server 1, and one for the disk on server 4. If the next week, servers 3-5 have disks w/ significant change, I want the view/dashboard to display three graphs/panels, one for server3, one for server4, one for server5

acdevlin
Communicator

Absolutely! Check out the following app for some examples and ideas: http://splunk-base.splunk.com/apps/22333/splunk-ui-examples-app-for-41

The source code for all examples can be found in the Manager. You should be able to do what you want using simplified xml; I'd strongly recommend looking at the "Form Search Intro" section, since I believe it is most relevant to what you're looking for.

You could also check out the documentation about putting a chart in a dashboard: http://docs.splunk.com/Documentation/Splunk/latest/Developer/AddAChart

0 Karma

jeffa
Path Finder

Multiple panels are a key requirement. Ultimately I want to email this dashboard as a PDF, so no user interaction will be possible for that.

0 Karma

acdevlin
Communicator

I can think of one potential alternative, though. What if you set up a dashboard to:

1) Search for the disks which changed in the last week

2) Dynamically populate a dropdown menu based on the disks returned from step 1

3) Use the disk selected from the dropdown to populate a single panel containing the data you want to see.

Would this work for your current project, or are multiple panels a key requirement?

0 Karma

acdevlin
Communicator

Ah, I did misunderstand you a bit earlier...my mistake!

This old answer seems to have something relevant, though I have not tried this myself: http://splunk-base.splunk.com/answers/11813/how-to-dynamically-generate-a-dashboard-in-which-the-of-...

It, unfortunately, seems rather complicated...

0 Karma

jeffa
Path Finder

Thanks for the suggestion on the ui examples app. I may be missing something, but I don't see what I'm looking for in those examples. I may need to be wording this better, but what I want to do is populate a dashboard with a dynamically generated set of panels. The number of panels (changed disks) and set of changed disks will be different from day to day.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...