Splunk Search

customize the chart display on selecting value from static multiselect option

vikashperiwal
Path Finder

HI,

I am trying to implement customized chart views, to state the issue

I have static multi select input with token "host" with ALL has a value., the query has time chart some thing

| timechart span=15m avg(a1) as "session_current" by host ,

now when ALL is selected from multi select input i see all the host in the legends in chart that ALL has, but instead of showing the values i want to show only "WEST" in the chart legends

0 Karma

to4kawa
Ultra Champion

sample( index=_internal😞

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>field1</label>
      <choice value="sourcetype">ALL</choice>
      <choice value="&quot;WEST&quot;">WEST</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal
| eval sourcetype=$field1$
| timechart count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

vikashperiwal
Path Finder

Here s some confusion, let me explain more on my issue

Multiselect

    <label>West Node</label>
    <choice value="ABBRLW-SPGW-05">ALL</choice>
  </input>

Query:
index=cisco_asr5k_bulkstats sourcetype="cisco:asr5k:spgw:apn:apnSch2" apn ="ctracker.telus.iot" schema_type=apn host IN ($tok_west_sess$) sess_curr=*

| timechart span=$timeresolution$ avg(a1) as "session_current" by host

So when All is selected from multiselect , chart i dont want to show the host name "ABBRLW-SPGW-05" but a dummay value "West" to be displayed

0 Karma

to4kawa
Ultra Champion
....
|rename ABBRLW-SPGW-05 as West

append finally.

0 Karma

vikashperiwal
Path Finder

this is my multiselect

    <label>East Node</label>
    <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice>
    <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice>
    <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice>
    <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice>
  </input>

when ALL is selected , instead of showing the values in chart it should show "WEST",

Only for ALL it should show value as "WEST"

| timechart span=15m avg(a1) as "session_current" by host

0 Karma

to4kawa
Ultra Champion

The dashboard won't work with the information you're presenting.
There is not token.

0 Karma

vikashperiwal
Path Finder

Here it is

    <label>West</label>
 <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice>
 <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice>
 <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice>
 <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice>

This is just the multi select tab i am showing here, rest token is passed in my query.. query is working fine, only enhancement i want is for
when ALL is selected , instead of showing the values in chart it should show "WEST",

Only for ALL it should show value as "WEST"

| timechart span=15m avg(a1) as "session_current" by host

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...