Splunk Search

Is there a way to dynamically assign chart labels using a search?

mszebenyi_splun
Splunk Employee
Splunk Employee

Is there a way to dynamically assign chart labels using a search? My search ends with a timechart values(foo) as bar, values(baz) as qux. I have created searches to pull out the values from Splunk for the labels, but if I replace "bar" and "qux" as subsearches, the labels get a bit missed up and the chart data skews. My current environment is Splunk Enterprise 6.4 and 6.3. What am I missing? Thanks!

1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this (run anywhere sample). Here I'm setting the token in the search element to dynamically get the renamed column name.

<dashboard>
  <label>Dynamic_Chart Label</label>
  <search>
    <query>| gentimes start=-1 | eval splunkd="\"Splunk Engine\"" | eval splunk_web_access="\"Splunk Web\""| table splunkd splunk_web_access</query>
    <finalized>
      <condition>
        <set token="splunkd">$result.splunkd$</set>
        <set token="splunk_web_access">$result.splunk_web_access$</set>
      </condition>
    </finalized>
  </search>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd OR sourcetype=splunk_web_access | timechart count by sourcetype | rename splunkd as $splunkd$ splunk_web_access as $splunk_web_access$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>       
      </chart>
    </panel>
  </row>
</dashboard>

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try something like this (run anywhere sample). Here I'm setting the token in the search element to dynamically get the renamed column name.

<dashboard>
  <label>Dynamic_Chart Label</label>
  <search>
    <query>| gentimes start=-1 | eval splunkd="\"Splunk Engine\"" | eval splunk_web_access="\"Splunk Web\""| table splunkd splunk_web_access</query>
    <finalized>
      <condition>
        <set token="splunkd">$result.splunkd$</set>
        <set token="splunk_web_access">$result.splunk_web_access$</set>
      </condition>
    </finalized>
  </search>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd OR sourcetype=splunk_web_access | timechart count by sourcetype | rename splunkd as $splunkd$ splunk_web_access as $splunk_web_access$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>       
      </chart>
    </panel>
  </row>
</dashboard>

somesoni2
SplunkTrust
SplunkTrust

What version of Splunk you're using?

0 Karma

mszebenyi_splun
Splunk Employee
Splunk Employee

Splunk Enterprise 6.4 and 6.3.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...