Dashboards & Visualizations

How to use the drop down menu to change chart output on the dashboard?

angersleek
Path Finder

My logs looks as follows.

2018-04-16T14:55:59.661351812Z ns=test1 container_id=gitfdchvjbew7354e6rdf3h container_name=somejboss.dsjfhbv77-deployment-7-zhsdw_test1_0bewfjgh2-3325-gde8-a270-fa163e4bed7f_2958c3da message={"log": "\u001b[0m\u001b[0m07:55:59,660 INFO  [com.some.test.ty] (http-10.1.25.7:8888-111)  Thread[312] Class[com.some.test.one.controller.SomeController.getSomwthing] Message[  { Campaign=MYCampaign, ClientNm=myclient, CCC=111, anid=null, link=null, myCode:null, locale=en_US, someSource=null, encryptedSome:null} SERVICE=FIND_SOMETHING , FIND_SOMETHING_TIME_TAKEN=139 , clientNm=myclient , locale=en_US , STATUS=SUCCESS , ]\n", "stream": "stdout"} pod_container=jboss pod=test1-deployment-7-gfsdf 

I currently have made a search for ns=test* and got above log outputs.
I've made a filter gauge counting up all logs that has STATUS=SUCCESS. This gauge chart is now on my dashboard.

I want to add a dropdown field to my dashboard and use it to select different tests and make the chart change accordingly.
For example, instead of the current ns=test*, use the drop down options to search ns=test1, ns=test2 and so on.

The following is the 'search String' for my gauge chart.

| pivot my_model_name RootObject count(RootObject) AS "Count of 623547.938214_64B0B12-A261-4FE3-A9D7-4905CAT2BD74" FILTER STATUS startsWith URL ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1

Under the drop down static options, adding in data there seems to have no effect when I do a search.
Under the dynamic Options, tried adding ns=test1 to test but the chart just seems to halt.
Is there any way I can do this? Thanks.

0 Karma

niketn
Legend

Dynamic option looks for a query ideally you would put a query which gets you the unique ns name either using stats by ns or dedup ns. Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms#Static_and_dynamic_inputs_...

Can you please try the following query in Search bar and see if you get the list of unique ns values?

| tstats count from datamodel=my_model_name  BY ns
| fields ns

If it does use this as the query for Dynamic Options.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

angersleek
Path Finder

I am in Verbose mode and when I do the search, I seem to get lots of events, yet after awhile the search results says 'No Results found' using the above query.

Just to test, added the query 'ns=test1' to Dynamic Options over at dashboard.
Field for label: Orange.
Field for Value: Apple.

Getting the error message: 'Duplicate values causing conflict'.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...