Dashboards & Visualizations

Making dashboard efficient

deepak02
Path Finder

Hi,

(I have attached the code I have used as a 'Run anywhere' example.)

WHAT I HAVE
I have a dashboard which initally displays a list of batch jobs,

  • Batch Job 1
  • Batch Job 2
  • Batch Job 3
  • Batch Job 4

When I click on any of the job names, I want 2 tables to be displayed below it,

Latest Job information, Job statistics

I have managed to make this work by using the logic,

  <row>
    <panel>
      <html>
      <a href="?showBatchJob1=true">
          <h1>Batch Job 1</h1>
        </a>
    </html>
    </panel>
  </row>
  <row depends="$showBatchJob1$">
<!---------------------------------------------------
Code to display the two tables 
------------------------------------------------------>
</row>

WHAT I NEED:

The problem is, when each of the links are clicked, the entire page is reloaded and the data is taking a long time to load.
Is there a quicker way of doing this?

Thanks,
Deepak

FULL CODE:

<dashboard>
  <label>Mockup</label>
  <row>
    <panel>
      <html>
      <a href="?showBatchJob1=true">
          <h1>Batch Job 1</h1>
        </a>
    </html>
    </panel>
  </row>
  <row depends="$showBatchJob1$">
    <panel>
      <title></title>
      <table>
        <title>Latest Job Information</title>
        <search>
          <query>index=* 
| eval "Last Job ended" ="00:00:00" 
| eval "Job Status"="NOT DEFINED" 
| eval "Duration per Event" =0 
| eval "No. of Events" =0 
| stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events" 
| transpose 
| rename column as "Statistic" 
| rename "row 1" as "Value"</query>
          <earliest>rt-10s</earliest>
          <latest>rtnow</latest>
        </search>
      </table>
    </panel>
    <panel>
      <table>
        <title>Job Statistics</title>
        <search>
          <query>index=* 
| eval "Start Date"=strftime(now(),"%Y-%m-%d") 
| eval "Start Time"=strftime(now(),"%T") 
| eval "End Date"=strftime(now(),"%Y-%m-%d") 
| eval "End Time"=strftime(now(),"%T") 
| eval "Duration in minutes"=0 
| eval Status="INCOMPLETE" 
| eval "No. of Records"=0 
| table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <a href="?showBatchJob2=true">
          <h1>Batch Job 2</h1>
        </a>
    </html>
    </panel>
  </row>
  <row depends="$showBatchJob2$">
    <panel>
      <title></title>
      <table>
        <title>Latest Job Information</title>
        <search>
          <query>index=main 
| eval "Last Job ended" ="00:00:00" 
| eval "Job Status"="NOT DEFINED" 
| eval "Duration per Event" =0 
| eval "No. of Events" =0 
| stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events" 
| transpose 
| rename column as "Statistic" 
| rename "row 1" as "Value"</query>
          <earliest>rt-10s</earliest>
          <latest>rtnow</latest>
        </search>
      </table>
    </panel>
    <panel>
      <table>
        <title>Job Statistics</title>
        <search>
          <query>index=* 
| eval "Start Date"=strftime(now(),"%Y-%m-%d") 
| eval "Start Time"=strftime(now(),"%T") 
| eval "End Date"=strftime(now(),"%Y-%m-%d") 
| eval "End Time"=strftime(now(),"%T") 
| eval "Duration in minutes"=0 
| eval Status="INCOMPLETE" 
| eval "No. of Records"=0 
| table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <a href="?showBatchJob3=true">
          <h1>Batch Job 3</h1>
        </a>
    </html>
    </panel>
  </row>
  <row depends="$showBatchJob3$">
    <panel>
      <title></title>
      <table>
        <title>Latest Job Information</title>
        <search>
          <query>index=main 
| eval "Last Job ended" ="00:00:00" 
| eval "Job Status"="NOT DEFINED" 
| eval "Duration per Event" =0 
| eval "No. of Events" =0 
| stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events" 
| transpose 
| rename column as "Statistic" 
| rename "row 1" as "Value"</query>
          <earliest>rt-10s</earliest>
          <latest>rtnow</latest>
        </search>
      </table>
    </panel>
    <panel>
      <table>
        <title>Job Statistics</title>
        <search>
          <query>index=* 
| eval "Start Date"=strftime(now(),"%Y-%m-%d") 
| eval "Start Time"=strftime(now(),"%T") 
| eval "End Date"=strftime(now(),"%Y-%m-%d") 
| eval "End Time"=strftime(now(),"%T") 
| eval "Duration in minutes"=0 
| eval Status="INCOMPLETE" 
| eval "No. of Records"=0 
| table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <a href="?showBatchJob4=true">
          <h1>Batch Job 4</h1>
        </a>
    </html>
    </panel>
  </row>
  <row depends="$showBatchJob4$">
    <panel>
      <title></title>
      <table>
        <title>Latest Job Information</title>
        <search>
          <query>index=main 
| eval "Last Job ended" ="00:00:00" 
| eval "Job Status"="NOT DEFINED" 
| eval "Duration per Event" =0 
| eval "No. of Events" =0 
| stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events" 
| transpose 
| rename column as "Statistic" 
| rename "row 1" as "Value"</query>
          <earliest>rt-10s</earliest>
          <latest>rtnow</latest>
        </search>
      </table>
    </panel>
    <panel>
      <table>
        <title>Job Statistics</title>
        <search>
          <query>index=* 
| eval "Start Date"=strftime(now(),"%Y-%m-%d") 
| eval "Start Time"=strftime(now(),"%T") 
| eval "End Date"=strftime(now(),"%Y-%m-%d") 
| eval "End Time"=strftime(now(),"%T") 
| eval "Duration in minutes"=0 
| eval Status="INCOMPLETE" 
| eval "No. of Records"=0 
| table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
Tags (2)
0 Karma

niketn
Legend

@deepak02, You can use link input instead of html anchor tags if you just want to set or unset the token. Following is an example of Link Switcher that you can use.

<input type="link" token="selToken">
  <label></label>
  <choice value="linkBatchJob1">Show Batch Job 1</choice>
  <choice value="linkBatchJob2">Show Batch Job 2</choice>
  <choice value="linkBatchJob3">Show Batch Job 2</choice>
  <change>
    <condition value="linkBatchJob1">
      <set token="showBatchJob1">true</set>
      <unset token="showBatchJob2"></unset>
      <unset token="showBatchJob3"></unset>
    </condition>
    <condition value="linkBatchJob2">
      <unset token="showBatchJob1"></unset>
      <set token="showBatchJob2">true</set>
      <unset token="showBatchJob3"></unset>
    </condition>
    <condition value="linkBatchJob1">
      <unset token="showBatchJob1"></unset>
      <unset token="showBatchJob2"></unset>
      <set token="showBatchJob3">true</set>
    </condition>
    <condition>
      <unset token="showBatchJob1"></unset>
      <unset token="showBatchJob2"></unset>
      <unset token="showBatchJob3"></unset>
    </condition>
  </change>
</input>

As far as performance optimization is concerned, have you posted original queries or are these some random mock queries?

Since you have provided mock queries, refer to following documents if you want to figure out search query optimization on your own:
https://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization
http://docs.splunk.com/Documentation/Splunk/latest/Search/Writebettersearches
https://docs.splunk.com/Documentation/Splunk/latest/Search/Realtimeperformanceandlimitations

If you want the community to help with specific query optimization, you will have to provide actual search query.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

deepak02
Path Finder

Thankyou! This is what I am looking for.

I am unable to accept as answer though.

0 Karma

niketn
Legend

Glad I was able to help... Let me convert it to answer.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@deepak02 Please accept if this has resolved your issue so that this question gets marked as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...