topic Re: Populate Dashboard/View with Panels/Graphs based on Search (Dynamic Dashboard) in Dashboards & Visualizations

Populate Dashboard/View with Panels/Graphs based on Search (Dynamic Dashboard)

jeffa — Tue, 30 Aug 2011 15:48:23 GMT

Is it possible to dynamically populate a dashboard/view with panels/charts based on search results? For example, I track disk utilization across my systems w/ Splunk, and I'd like to be able to create a dashboard of disk utilization graphs only for disks whose utilization has changed by a specified amount. In other words, of our 100+ disks, only 10 or so will have changed utilization over the last week, but the set of changed disks will not be the same from day to day.

So, I want one panel/chart per disk (with a few items for that disk charted). The number of disks, as well as which disks should be charted would be dynamic. So, if I have 5 servers w/ C: drives, and only servers 1 and 4 have significant change in the last week, I want the view/dashboard to display two graphs/panels, one for the disk on server 1, and one for the disk on server 4. If the next week, servers 3-5 have disks w/ significant change, I want the view/dashboard to display three graphs/panels, one for server3, one for server4, one for server5

Re: Populate Dashboard/View with Panels/Graphs based on Search (Dynamic Dashboard)

acdevlin — Tue, 30 Aug 2011 16:34:42 GMT

Absolutely! Check out the following app for some examples and ideas: http://splunk-base.splunk.com/apps/22333/splunk-ui-examples-app-for-41

The source code for all examples can be found in the Manager. You should be able to do what you want using simplified xml; I'd strongly recommend looking at the "Form Search Intro" section, since I believe it is most relevant to what you're looking for.

You could also check out the documentation about putting a chart in a dashboard: http://docs.splunk.com/Documentation/Splunk/latest/Developer/AddAChart

Re: Populate Dashboard/View with Panels/Graphs based on Search (Dynamic Dashboard)

jeffa — Wed, 31 Aug 2011 21:48:13 GMT

Thanks for the suggestion on the ui examples app. I may be missing something, but I don't see what I'm looking for in those examples. I may need to be wording this better, but what I want to do is populate a dashboard with a dynamically generated set of panels. The number of panels (changed disks) and set of changed disks will be different from day to day.

Re: Populate Dashboard/View with Panels/Graphs based on Search (Dynamic Dashboard)

acdevlin — Wed, 31 Aug 2011 23:37:18 GMT

Ah, I did misunderstand you a bit earlier...my mistake!

This old answer seems to have something relevant, though I have not tried this myself: http://splunk-base.splunk.com/answers/11813/how-to-dynamically-generate-a-dashboard-in-which-the-of-panels-is-equal-to-the-of-hosts

It, unfortunately, seems rather complicated...

Re: Populate Dashboard/View with Panels/Graphs based on Search (Dynamic Dashboard)

acdevlin — Wed, 31 Aug 2011 23:39:05 GMT

I can think of one potential alternative, though. What if you set up a dashboard to:

1) Search for the disks which changed in the last week

2) Dynamically populate a dropdown menu based on the disks returned from step 1

3) Use the disk selected from the dropdown to populate a single panel containing the data you want to see.

Would this work for your current project, or are multiple panels a key requirement?

Re: Populate Dashboard/View with Panels/Graphs based on Search (Dynamic Dashboard)

jeffa — Fri, 02 Sep 2011 14:58:37 GMT

Multiple panels are a key requirement. Ultimately I want to email this dashboard as a PDF, so no user interaction will be possible for that.