Dashboards & Visualizations

Timechart, timewrap by day

sandeepmakkena
Contributor

I have few question the dashboard, any help is appreciated
1. can we do any optimizations on the search querie ?
2. It is displaying the same date, when we movie mouse over the graph need help in fixing it?
3. I would also like to display date rather than 1day ag0, 2days ago and so on ?
4. On the last bar chart I would like to display, bar graph for each day separately ?

<form>
  <label>Real  (Test)</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="level" searchWhenChanged="true">
      <label>Pick the TimeRange:</label>
      <choice value="-6d@d">Last 7 days</choice>
      <choice value="-5d@d">Last 6 days</choice>
      <choice value="-4d@d">Last 5 days</choice>
      <choice value="-3d@d">Last 4 days</choice>
      <choice value="-2d@d">Last 3 days</choice>
      <choice value="-1d@d">Last 2 days</choice>
      <default>Last 2 days</default>
      <change>
        <condition value="-6d@d">
          <set token="s_level">1day</set>
          <set token="s_end">-6d@d</set>
        </condition>
        <condition value="-5d@d">
          <set token="s_level">1day</set>
          <set token="s_end">-5d@d</set>
        </condition>
        <condition value="-4d@d">
          <set token="s_level">1day</set>
          <set token="s_end">-4d@d</set>
        </condition>
        <condition value="-3d@d">
          <set token="s_level">1day</set>
          <set token="s_end">-3d@d</set>
        </condition>
        <condition value="-2d@d">
          <set token="s_level">1day</set>
          <set token="s_end">-2d@d</set>
        </condition>
        <condition value="-1d@d">
          <set token="s_level">1day</set>
          <set token="s_end">-1d@d</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Total transactions</title>
      <chart>
        <search>
          <query>sourcetype=aa OR sourcetype=bb TransactionId=TID* AND TransactionId!=TID
| timechart count span=1h | timewrap 1day</query>
          <earliest>$s_end$</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">area</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel>
      <title>Total Successful transactions</title>
      <chart>
        <search>
          <query>sourcetype="aa" TransactionId=TID*
| search eventName="POSTING:SUCCEEDED"
| timechart dc(TransactionId) as Successful_transactions span=1h | timewrap 1day</query>
          <earliest>$s_end$</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">area</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel>
      <title>Total Rejected transactions</title>
      <chart>
        <search>
          <query>sourcetype="aa" TransactionId=TID*
| search "processingStatusCode":"REJECTED"
| timechart dc(TransactionId) as Successful_transactions span=1h | timewrap 1day</query>
          <earliest>$s_end$</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">area</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Received Real Time payments status</title>
      <chart>
        <search>
          <query>sourcetype="aa" OR sourcetype="bb" TransactionId=TID* AND TransactionId!=TID
| eval Status=if(like(_raw, "%POSTING:SUCCEEDED%"), "2.Successful transactions" , "1.Rejected Transactions") 
| timechart count by Status</query>
          <earliest>$s_end$</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisTitleY.text">Number of transactions</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.seriesColors">["0xFF3333","0x65a637"]</option>
        <drilldown>
          <set token="click_earliest">$earliest$</set>
          <set token="click_latest">$latest$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...