Dashboards & Visualizations

I have a chart question

gnovak
Builder

Well hello there....

I have been reading about the charting options and I'm still a bit lost on how to change something.

I originally had a single value display that looked like this on a dashboard:

<label>Balance Email Summary - Last 24 Hours</label>
<row>
<single>
  <title>Total Emails To Send For All Registries</title>
  <searchName>balance_email_to_send</searchName>
  <fields>TotalEmailsToSend</fields>
</single>
<single>
  <title>Total Emails Sent To All Registries</title>
  <searchName>balance_email_sent</searchName>
  <fields>TotalEmailsSent</fields>
</single>

I now wanted to take out the single and make it into a chart. The problem is if I do that, the values at the bottom of the chart are not reflecting on the numbers that are present after the search is complete. The numbers only go from 0-100 and I really would need them to go from like 1000 to 2000.

How can you change the numbers at the bottom of the chart?

Tags (1)
0 Karma

gnovak
Builder

advanced xml is here i believe:

  <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Total Emails To Send For All Registries" autoRun="True">
<param name="savedSearch">balance_email_to_send</param>
<param name="groupLabel">Total Emails To Send For All Registries</param>
<module name="ViewstateAdapter">
  <param name="savedSearch">balance_email_to_send</param>
  <module name="HiddenFieldPicker">
    <param name="fields">TotalEmailsToSend</param>
    <param name="strictMode">True</param>
    <module name="JobProgressIndicator">
      <module name="EnablePreview">
        <param name="enable">True</param>
        <param name="display">False</param>
        <module name="HiddenChartFormatter">
          <param name="charting.chart">bar</param>
          <module name="FlashChart">
            <param name="width">100%</param>
            <param name="height">400</param>
            <module name="ConvertToDrilldownSearch">
              <module name="ViewRedirector">
                <param name="viewTarget">flashtimeline</param>
              </module>
            </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

0 Karma

gnovak
Builder

The search for "balance_email_to_send" looks like this:

sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="24" BalanceEmail sent | rex field=_raw "[BalanceEmail] ?(?[\d]+) of (?[\d]+) of email notification sent." | search TotalEmailsToSend="*" | chart sum(TotalEmailsToSend)

0 Karma

sideview
SplunkTrust
SplunkTrust

Can you add the search that you're using? Also the simplified XML converts to advanced XML under the hood and there's often problems in the conversion -- tacking ?showsource=1 on the URL, scrolling down and copying-and-pasting the advanced XML may reveal where it's gone wrong.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...