Dashboards & Visualizations

How can I set the range of my flashchart time axis by a value selected in a lister module?

erydberg
Splunk Employee
Splunk Employee

I want to set the range of the x-axis (time) of a chart depending on what the user selects in a lister module, but I'm not sure how to do that. I still want my search to be over all time, but I only want to display a part of the time. I tried intentions, and I can't make it work. I'm not sure if intentions is the way to do this, but I can't figure out an other way to pass down data. Anyone who knows how to do this or has any ideas?

This is what I tried:

...
<module name="HiddenChartFormatter" layoutPanel="panel_row2_col1">
    <param name="chart">line</param>
    <param name="chart.nullValueMode">connect</param>
    <param name="primaryAxisTitle.text">Time</param>
    <param name="secondaryAxisTitle.text">Remaining issues</param>
    <param name="charting.primaryAxis.minimumTime">$earliest$</param>
    <param name="charting.primaryAxis.maximumTime">$latest$</param>
...

where $earliest$ and $latest$ are stringreplace intentions.

0 Karma
1 Solution

erydberg
Splunk Employee
Splunk Employee

Okay, so it seems like you can override the charting.primaryAxis.minimumTime for your chart by setting that as the setting to create in your lister module:

        <module name="SearchRadioLister" layoutPanel="panel_row1_col1_grp2">
            <param name="applyOuterIntentionsToInternalSearch">true</param>
            <param name="search">`earliest_sprint_date($sprint$)`</param>
            <param name="settingToCreate">charting.primaryAxis.minimumTime</param>
            <param name="searchFieldsToDisplay">
                <list>
                    <param name="value">startdate</param>
                    <param name="label">startdate</param>
                </list>
            </param>

and then do the same for charting.primaryAxis.maximumTime.

View solution in original post

0 Karma

erydberg
Splunk Employee
Splunk Employee

Okay, so it seems like you can override the charting.primaryAxis.minimumTime for your chart by setting that as the setting to create in your lister module:

        <module name="SearchRadioLister" layoutPanel="panel_row1_col1_grp2">
            <param name="applyOuterIntentionsToInternalSearch">true</param>
            <param name="search">`earliest_sprint_date($sprint$)`</param>
            <param name="settingToCreate">charting.primaryAxis.minimumTime</param>
            <param name="searchFieldsToDisplay">
                <list>
                    <param name="value">startdate</param>
                    <param name="label">startdate</param>
                </list>
            </param>

and then do the same for charting.primaryAxis.maximumTime.

0 Karma

sideview
SplunkTrust
SplunkTrust

Im still a little fuzzy on what's driving these choices. But I think you're going to have to accept the necessity of running the report again to view the narrowed timerange. With the exception of timechart, its not possible in general to see just a particular timerange within an arbitrary report without rerunning the report. And even to do it with timechart would require a bit of custom code.

But here are some ideas:

1) You can put a TimeRangePicker above the FlashChart, default it to 'All Time', but let the user change the timerange. Of course this will trigger a second search with the modified timerange.

2)You can put a TimeRangePicker module and then inside that a FlashTimeline module, and then inside that your FlashChart.
This will allow people to click and drag timeranges on the FlashTimeline, and have the report run over just that timerange and appear in the FlashChart. (naturally the search will re-run). They can even zoom in and zoom out (effectively that just punts the zoomed-in and zoomed-out timeranges up to the TimeRangePicker module)

3) You can use a Switcher module like LinkSwitcher/PulldownSwitcher to fork the hierarchy below the switcher into N different sub-branches. Each branch would have just a HiddenSearch module that specifies only earliest/latest params and leaves the search string unchanged. And then each branch would have an identical FlashChart under that. This could give you a 'day before yesterday' vs 'yesterday' vs 'today' vs 'alltime'.
However a) if the data might be over just a few hours or it might be over a few months, any particular choice here is going to fall down in some case. B) it gets very cumbersome to duplicate that much XML so switchers are a tool of last resort.

4) you could follow the steps in #3, but instead of having HiddenSearch, you can have HiddenPostProcess modules. If this were a timechart, and if you had apriori knowledge of what scale timebuckets were coming out (ie always hours or always days), and if you were to write the pipes to eval and convert such that you could turn the bucketed string times into epochTimes, then you could filter conditionally based on timerange, without dispatching another search....

0 Karma

erydberg
Splunk Employee
Splunk Employee

I'm trying to do a burndown chart from Jira issues, which forces me to do searches over all time to get the current state of an issue, and then I want the chart to plot over the actual dates for a sprint, so just a couple of weeks. So it's a SearchEntityLister with sprint names and dates that I want to set the flashchart's x-axis properties with. Does that make any sense?

0 Karma

sideview
SplunkTrust
SplunkTrust

There's a couple ways to go, but since your search is run over all time I assume the effective timeranges would be quite different from case to case so what kind of options would you want in such a pulldown?

0 Karma

erydberg
Splunk Employee
Splunk Employee

I want my search to be run over all time, so I'll have results from all time in a time chart and I only want to filter the time that's displayed, not change the actual search. The time picked will affect the search, right? Or can I filter my search results with the time picker?

0 Karma

sideview
SplunkTrust
SplunkTrust

Is there a strong reason to not just put a TimeRangePicker in there? You can also put a FlashTimeline in there.... This is not commonly done but it is quite cool.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...