Hey Splunk Wizards,
I have a simple dash board that displays a graph and table of some storage information. The XML looks like this:
< ?xml version='1.0' encoding='utf-8'?>
< dashboard>
< label>NAS Usage< /label>
< row>
< chart>
< searchString>index=usagereport sourcetype="nasoverall"| timechart max(Total_Space) as "Total Space Allocated" max(Used_Space) as "Space Used"< /searchString>
< title>Total NAS Usage by Filer< /title>
< earliestTime>-14d< /earliestTime>
< latestTime>now< /latestTime>
< option name="charting.axisTitleX.text">Date< /option>
< option name="charting.axisTitleY.text">Space in TB< /option>
< option name="charting.axisY.maximumNumber">50< /option>
< option name="charting.axisY.minimumNumber">0< /option>
< option name="charting.chart">line< /option>
< option name="charting.primaryAxisTitle.text"/>
< option name="charting.secondaryAxisTitle.text"/>
< option name="count">10< /option>
< option name="displayRowNumbers">true< /option>
< option name="maxLines">10< /option>
< option name="segmentation">outer< /option>
< option name="softWrap">true< /option>
< /chart>
< /row>
< row>
< table>
< searchString>index=usagereport sourcetype=nasreport_log Filer_Name="*" | rename Aggr as "Aggregate", Volume_Total as "Total Allocated", Volume_Used as "Used Space" | table Volume "Total Allocated" "Used Space" "Aggregate" | sort +Aggregate< /searchString>
< title>Disk Usage< /title>
< earliestTime>@d< /earliestTime>
< latestTime>now< /latestTime>
< option name="count">50< /option>
< option name="displayRowNumbers">false< /option>
< option name="drilldown">row< /option>
< /table>
< /row>
< /dashboard>
I have an extracted field called "Filer" and right now all the data from every filer is being shown. What I would like to do is have a pull-down menu at the top of this dashboard that displays all the differing "Filers." Once a filer is selected from the pull down, all the data for that filer is shown in the graph and the table.
Thanks so much,
Matt
... View more