Hi.
I have a pie chart based on a given criterion, but it only shows one pie chart at a time from my dashboard. Is there a way to create all the pie charts by looping the criteria?
Thanks.
You have to do something like this:
<form>
<label>Log Search</label>
<fieldset submitButton="true">
<input type="time" token="Time">
<label>Periodo eventi</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<search id="first_search">
<query>tag=...</query>
<earliest>$Time.earliest$</earliest>
<latest>$Time.latest$</latest>
</search>
<row>
<panel>
<chart>
<title>Top 20 Operators</title>
<search base="first_search">
<query>stats sum(count) AS count by field1</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
</chart>
</panel>
<panel>
<chart>
<title>Top 20 SS</title>
<search base="first_search">
<query>stats sum(count) AS count by SS</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">0</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
</chart>
</panel>
<panel>
<chart>
<title>Top 20 Customers</title>
<search base="first_search">
<query>stats sum(count) AS count by Customer </query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">0</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
</chart>
</panel>
</row>
</form>
In other words, you have to create your base search in the beginning of your dashboard (usually after fieldset) and recall it in your searches using the id (base = id); in every search you insert the specific part of each search and you don't need to use "|" in the beginning of each search.
You can find help in Dashboard Examples App that you can download at https://splunkbase.splunk.com/app/1603/.
Bye.
Giuseppe
I think you're referring to post-processing. Your first search will feed the other searches to reduce the overall search load
http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/Savedsearches
Hi skoelpin, thank you for the link, but it doesn't have information I needed.
Can you clarify your question a bit more?
I have a dropdown contain a list of server names, when a server is selected, a pie chart shows all the statistics. Instead of clicking one server name at a time, I would like to show all the pie charts associated with all servers into one dashboard.