All Apps and Add-ons

scale up a radial gauge from lookup

jagresz
Explorer

I'd like to have a real-time radial gauge which scales up values coming from a csv file. The csv contains only one line:

min,max,avg

6,186,96

These values should be params at rangeValues, but tokens give no values at all for it. The xml looks like this:

<module name="Search" layoutPanel="panel_row1_col1_grp1" autoRun="True">

 <param name="search"> | inputlookup lookuptablename</param>

   <module name="ResultsValueSetter">

    <param name="fields">min max avg</param>

    <module name="HiddenSavedSearch">

     <param name="savedSearch">savedsearchname</param>

     <module name="HiddenChartFormatter">

      <param name="charting.chart">radialGauge</param>

      <param name="charting.rangeValues">[0,$min$,$avg$,$max$]</param>

      <param name="charting.gaugeColors">[0x84e900,0xffe800,0xbf3030]</param>

      <module name="FlashChart">

       <param name="width">100%</param>

       <param name="height">170px</param>

      </module>

      <module name="HTML">

       <param name="html">

       <![CDATA[

        <p align="center">Authentication events</p>

        <p align="center">Minimum: $min$</p>

        <p align="center">Average: $avg$</p>

        <p align="center">Maximum: $max$</p>

        ]]>

       </param>

      </module>

     </module>

    </module>

   </module>

  </module>

The gauge stays at default 0-100 scale but the HTML code below gives the correct values, so I think ResultsValueSetter and tokens work fine.
Isn't is possible to give token values to rangeValues? Or I am missing something?

Thanks in advance,

Jagresz

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

It's actually pretty simple and you're figured out the hard parts already.

Skipping to the end, all the HiddenChartFormatter module does is create context keys for downstream modules. So "charting.rangeValues" is just another key, and if you were to put $charting.rangeValues$ into an HTML module downstream of that HiddenChartFormatter, you'd see it printed out.

So just take your three keys "min", "max" and "avg", and make a single key called "charting.rangeValues", and this is exactly what the "ValueSetter" module does.

<module name="Search" layoutPanel="panel_row1_col1_grp1" autoRun="True">
  <param name="search"> | inputlookup lookuptablename</param>

    <module name="ResultsValueSetter">
      <param name="fields">min max avg</param>

      <module name="ValueSetter">
        <param name="name">charting.rangeValues"</param>
        <param name="value">[0,$min$,$avg$,$max$]</param>

Put your gauge chart downstream from that and it'll work.

Or another way is to use the search language to do your dirty work:

<module name="Search" layoutPanel="panel_row1_col1_grp1" autoRun="True">
  <param name="search"> | inputlookup lookuptablename | eval charting.rangeValues="[0,"+min+","+avg+","+max+"]"</param>

    <module name="ResultsValueSetter">
      <param name="fields">charting.rangeValues</param>

Although the search language abuse there is a little gratuitous

View solution in original post

jagresz
Explorer

I had to change params charting.* to charting.chart.*, this and your code did the trick.
Thanks again!

0 Karma

sideview
SplunkTrust
SplunkTrust

Oh and with both of these ways, you'll still need the HiddenChartFormatter, just dont have the HiddenChartFormatter set that one charting.rangeValue key, because a) it'll be already set from the ResultsValueSetter, and b) if you do set it from HiddenChartFormatter you would clobber the RVS one.

0 Karma

sideview
SplunkTrust
SplunkTrust

Sorry about that. I just had a big typo in there and I fixed it inline. ValueSetter is a module in Sideview Utils. It's a little utility module you need once in a while to clone or rename a key around. It can also split string-valued keys into array-valued keys, which is useful for prepopulating multiselect Pulldown modules.

0 Karma

jagresz
Explorer

Thanks for your quick reply!

In your first version I got an error message:
"Misconfigured view 'viewname' - Parameter 'value' is required for module ValueSetter".
What is the ValueSetter value in this case? I don't know whether or not it's a tpyo but there's an unbalanced quote and a > sign at the name.

In the second case I can print the value of charting.rangeValue but it leaves gauge alone.. 😞
Any idea?

Thanks in advance!

J.

0 Karma

sideview
SplunkTrust
SplunkTrust

It's actually pretty simple and you're figured out the hard parts already.

Skipping to the end, all the HiddenChartFormatter module does is create context keys for downstream modules. So "charting.rangeValues" is just another key, and if you were to put $charting.rangeValues$ into an HTML module downstream of that HiddenChartFormatter, you'd see it printed out.

So just take your three keys "min", "max" and "avg", and make a single key called "charting.rangeValues", and this is exactly what the "ValueSetter" module does.

<module name="Search" layoutPanel="panel_row1_col1_grp1" autoRun="True">
  <param name="search"> | inputlookup lookuptablename</param>

    <module name="ResultsValueSetter">
      <param name="fields">min max avg</param>

      <module name="ValueSetter">
        <param name="name">charting.rangeValues"</param>
        <param name="value">[0,$min$,$avg$,$max$]</param>

Put your gauge chart downstream from that and it'll work.

Or another way is to use the search language to do your dirty work:

<module name="Search" layoutPanel="panel_row1_col1_grp1" autoRun="True">
  <param name="search"> | inputlookup lookuptablename | eval charting.rangeValues="[0,"+min+","+avg+","+max+"]"</param>

    <module name="ResultsValueSetter">
      <param name="fields">charting.rangeValues</param>

Although the search language abuse there is a little gratuitous

redc
Builder

I figured out a way around the behavior which actually works better for what I'm doing. So...nevermind. 🙂

0 Karma

sideview
SplunkTrust
SplunkTrust

Can you post this as a separate question? It sounds only tangentially related to this question. I also don't really understand your description so if you can post XML or pseudo-XML I can give better advice.

0 Karma

redc
Builder

Should mention: I have three different searches populating three different radial gauges on the same dashboard here, which is why I'm using the Gate module.

0 Karma

redc
Builder

I'm using the Gate module to push the results to target panels farther down the page, but no matter how I wrap the ResultsValueSetter and/or the ValueSetter, the Gate module behaves weird:

With the Gate module as a child of ResultsValueSetter or ValueSetter modules, nothing displays in the target panel.

With the Gate module outside the ResultsValueSetter or ValueSetter modules, the charting.chart.rangeValues token doesn't make it down into the target panel.

If I put the Gate module in both places (as a child of AND outside the modules), it gets 0,$max$.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...