topic Re: How to display multi select value on the title of a panel in Dashboards & Visualizations

How to display multi select value on the title of a panel

RRajneesh — Fri, 06 Apr 2018 12:03:54 GMT

Hello,

I want only the value of my multi select to appear on the title of the panel. But actually, both the technical field name along with the value is getting displayed.

Can you please help ?

Thanks.

King Regards,
Rajneesh.

Re: How to display multi select value on the title of a panel

mayurr98 — Fri, 06 Apr 2018 13:11:37 GMT

It would be better if you post the XML and expected output for your code.

Re: How to display multi select value on the title of a panel

RRajneesh — Fri, 06 Apr 2018 13:15:31 GMT

Hi,

My multiselect :

  <label>Avril / TMA</label>
  <choice value="*">All</choice>
  <default>*</default>
  <initialValue>*</initialValue>
  <fieldForLabel>problem_mapping</fieldForLabel>
  <fieldForValue>problem_mapping</fieldForValue>
  <search>
    <query>sourcetype=aiam_itsm_ticket_stesofiproteo1 | dedup problem_mapping | table problem_mapping | sort problem_mapping</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
  <delimiter> OR </delimiter>
  <prefix>(</prefix>
  <valuePrefix>problem_mapping="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <suffix>)</suffix>
</input>

My panel :

<panel>
  <chart>
    <title>Entrée/Sortie/Backlog - $problem_mapping$ </title>
    <search>
      <query>* I HAVE MY QUERY HERE*</query>
      <earliest>$time.earliest$</earliest>
      <latest>$time.latest$</latest>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
    <option name="charting.axisTitleX.text">Semaine</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Ticket</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisY2.enabled">1</option>
    <option name="charting.axisY2.scale">log</option>
    <option name="charting.chart">column</option>
    <option name="charting.chart.overlayFields">Backlog</option>
    <option name="charting.chart.showDataLabels">all</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.drilldown">none</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.placement">bottom</option>
    <option name="charting.fieldColors">
      {"Entrée": 0xFF0000, "Sortie": #008000 , "Backlog":0x0066FF}
    </option>
    <option name="charting.chart.columnSpacing">10</option>
    <option name="trellis.enabled">0</option>
  </chart>
</panel>

Thanks.

Re: How to display multi select value on the title of a panel

mayurr98 — Fri, 06 Apr 2018 14:10:55 GMT

Try this run anywhere XML

<form>
  <label>Sample Multiselect panel title</label>
  <fieldset>
    <input type="multiselect" token="log_level">
      <label>log_level</label>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>log_level</fieldForLabel>
      <fieldForValue>log_level</fieldForValue>
      <search>
        <query>index=_internal 
|  dedup log_level 
|  table log_level</query>
        <earliest>@d</earliest>
        <latest>now</latest>
      </search>
      <delimiter>,</delimiter>
    </input>
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Entrée/Sortie/Backlog - $log_level$</title>
        <search>
          <query>index=_internal log_level IN ($log_level$)</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.text">Semaine</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.text">Ticket</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.scale">log</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.columnSpacing">10</option>
        <option name="charting.chart.overlayFields">Backlog</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"Entrée": 0xFF0000, "Sortie": #008000 , "Backlog":0x0066FF}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
      </chart>
    </panel>
  </row>
</form>

You would need to do some changes in search query and multiselect filter XML.
your multiselect should be

<input type="multiselect" token="problem_mapping">
      <label>log_level</label>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>problem_mapping</fieldForLabel>
      <fieldForValue>problem_mapping</fieldForValue>
      <search>
     <query>sourcetype=aiam_itsm_ticket_stesofiproteo1 | dedup problem_mapping | table problem_mapping | sort problem_mapping</query>
     <earliest>0</earliest>
     <latest></latest>
   </search>
      <delimiter>,</delimiter>
    </input>

and in panel your search query should be something like this

problem_mapping  IN ($problem_mapping$)

which is equivalent to problem_mapping=value1 OR problem_mapping=value2 OR problem_mapping=value3 and so on..

Re: How to display multi select value on the title of a panel

DalJeanis — Fri, 06 Apr 2018 16:23:43 GMT

Note - for posterity's sake, you should probably note what Splunk release this is valid on.

IIRC, I believe the IN syntax became available in 6.6.

For 6.5 and below, you'd use something like this...

   <label>log_level</label>
   <choice value="*">All</choice>
   <default>*</default>
   <initialValue>*</initialValue>
   <fieldForLabel>log_level</fieldForLabel>
   <fieldForValue>log_level</fieldForValue>
   <search>
     <query>index=_internal
         | stats count by log_level 
         | table log_level
     </query>
     <earliest>@d</earliest>
     <latest>now</latest>
   </search>    

   <prefix>(</prefix>
   <valuePrefix>log_level="</valuePrefix>
   <valueSuffix>"</valueSuffix>
   <delimiter> OR </delimiter>
   <suffix>)</suffix>

And the query would have this...

     <query>index=_internal  $log_level$</query>