Splunk Search

Grouping multiple pie charts and adding them in the drop down menu

bollam
Path Finder

Hello,

I have a couple of dashboards which contains two pie charts of two nodes. I want to merge these dashboards into one. I want to group pie charts of one dashboard and put it in the drop down menu and similarly the other one.
For an instance: I want to group node1 and node2 to the value of dashboard1 and node3 and node4 to the value of dashboard2 in the dropdown. When I choose dashboard1 the piecharts of node1 and node2 should only be displayed. When I choose dashboard2 the piecharts of node3 and node4 should only be displayed.

Please find the source of one of my dashboards and the other dashboard content will also be similar to this.

<dashboard>
  <label>UsedVsAvailable</label>
  <row>
    <panel>
      <title>PieChart</title>
      <chart>
        <title>Node1</title>
        <search>
          <query>index=sai_core source="*size*" Name="Sai Kumar" | head 1
| eval ConsumedSpace = TotalSpace - AvailableSpace 
| table ConsumedSpace AvailableSpace 
| transpose</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <!--option name="width">50</option-->
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.showLabels">0</option>
        <option name="charting.chart.showPercent">0</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">1</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">left</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">250</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
    <panel>
      <title>AvailableVsTotal</title>
      <chart>
        <title>Node2</title>
        <search>
          <query>index=sai_core source="*size*" Name="Sai Kumar" | head 1
| eval ConsumedSpace = TotalSpace - AvailableSpace 
| table TotalSpace AvailableSpace
| transpose</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>
Tags (2)
0 Karma

harishalipaka
Motivator

Hi @bollam try below example

<form>
  <label>hideshow</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="selected" searchWhenChanged="true">
      <label>Your Token</label>
      <choice value="dashboard1">dashboard1</choice>
      <choice value="dashboard2">dashboard2</choice>
      <default>dashboard1</default>
      <change>
        <condition value="dashboard1">
          <set token="dashboard1"></set>
          <unset token="dashboard2"></unset>
        </condition>
        <condition value="dashboard2">
          <unset token="dashboard1"></unset>
          <set token="dashboard2"></set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$dashboard1$">
      <title>|stats count by $selected$</title>
      <chart>
        <title>Node1</title>
        <search>
          <query>|makeresults |eval tokenvalue=20 |append [|makeresults |eval tokenvalue=50]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$dashboard1$">
      <title>|stats count by $selected$</title>
      <chart>
        <title>Node2</title>
        <search>
          <query>|makeresults |eval tokenvalue=10 |append [|makeresults |eval tokenvalue=80]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$dashboard2$">
      <title>|stats count by $selected$</title>
      <chart>
        <title>Node3</title>
        <search>
          <query>|makeresults |eval tokenvalue=50 |append [|makeresults |eval tokenvalue=40]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$dashboard2$">
      <title>|stats count by $selected$</title>
      <chart>
        <title>Node4</title>
        <search>
          <query>|makeresults |eval tokenvalue=28 |append [|makeresults |eval tokenvalue=70]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>
Thanks
Harish

bollam
Path Finder

Awesome! It worked for me.. Thank you

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...