How to edit my search to display a bubble chart in...

SENTHAMIZHMCA · ‎05-09-2016

Below is working::

<panel>
  <html>
        <h2>Bubble Chart 2</h2>
        <div id="bubbleSearch2"
             class="splunk-manager"
             data-require="splunkjs/mvc/searchmanager"
             data-options='{
                "search": "index=IT-APP-BSS (Application = ARBOR OR Application = AR OR Application = CMBS OR Application = ICT)",

                "status_buckets": 0,
                "cancelOnUnload": true,
                "auto_cancel": 90,
                "preview": true
             }'>
        </div>
        <div id="bubbleChart2"
             class="splunk-view"
             data-require="app/simple_xml_examples/components/bubblechart/bubblechart"
             data-options='{
                "managerid": "bubbleSearch2",
                "nameField": "processor",
                "categoryField": "name",
                "valueField": "hits",
                "height": 450
             }'>
        </div>
    </html>
</panel>

Below is not working:

<panel>
  <html>
        <h2>Bubble Chart 2</h2>
        <div id="bubbleSearch2"
             class="splunk-manager"
             data-require="splunkjs/mvc/searchmanager"
             data-options='{
                "search": "index="IT-APP-BSS" (Application = ARBOR OR Application = AR OR Application = CMBS OR Application = ICT) | eval newdate=strftime(strptime(ReportTime, &quot;%d/%m/%Y %H:%M&quot;),&quot;%d/%m/%Y %H:%M&quot;)",

                "status_buckets": 0,
                "cancelOnUnload": true,
                "auto_cancel": 90,
                "preview": true
             }'>
        </div>
        <div id="bubbleChart2"
             class="splunk-view"
             data-require="app/simple_xml_examples/components/bubblechart/bubblechart"
             data-options='{
                "managerid": "bubbleSearch2",
                "nameField": "processor",
                "categoryField": "name",
                "valueField": "hits",
                "height": 450
             }'>
        </div>
    </html>
</panel>

The issue is the search I am using for the bubble chart, but it does return events.

Can anyone help me here?

kasu_praveen · ‎05-10-2016

Try using "Fields" or "Table" command at the end of the query, such that it produces the required field for the bubble chart.
Refer: https://splunkbase.splunk.com/app/1603/ for further help.

How to edit my search to display a bubble chart in my dashboard?

Introducing the Splunk Community Dashboard Challenge!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...