Splunk Search

customize the chart display on selecting value from static multiselect option

vikashperiwal
Path Finder

HI,

I am trying to implement customized chart views, to state the issue

I have static multi select input with token "host" with ALL has a value., the query has time chart some thing

| timechart span=15m avg(a1) as "session_current" by host ,

now when ALL is selected from multi select input i see all the host in the legends in chart that ALL has, but instead of showing the values i want to show only "WEST" in the chart legends

0 Karma

to4kawa
Ultra Champion

sample( index=_internal😞

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>field1</label>
      <choice value="sourcetype">ALL</choice>
      <choice value="&quot;WEST&quot;">WEST</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal
| eval sourcetype=$field1$
| timechart count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

vikashperiwal
Path Finder

Here s some confusion, let me explain more on my issue

Multiselect

    <label>West Node</label>
    <choice value="ABBRLW-SPGW-05">ALL</choice>
  </input>

Query:
index=cisco_asr5k_bulkstats sourcetype="cisco:asr5k:spgw:apn:apnSch2" apn ="ctracker.telus.iot" schema_type=apn host IN ($tok_west_sess$) sess_curr=*

| timechart span=$timeresolution$ avg(a1) as "session_current" by host

So when All is selected from multiselect , chart i dont want to show the host name "ABBRLW-SPGW-05" but a dummay value "West" to be displayed

0 Karma

to4kawa
Ultra Champion
....
|rename ABBRLW-SPGW-05 as West

append finally.

0 Karma

vikashperiwal
Path Finder

this is my multiselect

    <label>East Node</label>
    <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice>
    <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice>
    <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice>
    <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice>
  </input>

when ALL is selected , instead of showing the values in chart it should show "WEST",

Only for ALL it should show value as "WEST"

| timechart span=15m avg(a1) as "session_current" by host

0 Karma

to4kawa
Ultra Champion

The dashboard won't work with the information you're presenting.
There is not token.

0 Karma

vikashperiwal
Path Finder

Here it is

    <label>West</label>
 <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice>
 <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice>
 <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice>
 <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice>

This is just the multi select tab i am showing here, rest token is passed in my query.. query is working fine, only enhancement i want is for
when ALL is selected , instead of showing the values in chart it should show "WEST",

Only for ALL it should show value as "WEST"

| timechart span=15m avg(a1) as "session_current" by host

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...