advanced xml charting

splunkpoornima — Tue, 23 Oct 2012 11:47:43 GMT

hi ,

i used the below XML code to create the bar chart for the durtaion count of TaskAction and if we drilldown it should the trend chart..

plz verify this XML and give inputs.. after running this code..its shows Splunk encountered the following unknown module: "count of duration" . The view may not load properly.

Custom wiring the clicks

*
False
1

dashboard

source="C:\Users\20875\Desktop\taskmanager_log.txt"| transaction TaskAction startswith=START endswith=Succeeded|chart count(duration) by TaskAction

bar
TaskName
count
none

100%
160px

    <!-- we swap out the search to be a timechart.  -->
    <module name="HiddenSearch">
      <param name="search">source="C:\\Users\\20875\\Desktop\\taskmanager_log.txt"| transaction TaskAction startswith=START endswith=Succeeded|timechart count(duration) by TaskAction </param>
           <!-- this module will grab the value we clicked on and put it in as a searchterm,   series="someSourcetype".   -->
      <module name="ConvertToIntention">
        <param name="intention">
          <param name="name">addterm</param>
          <param name="arg">
   <param Value="TaskAction">$click.value$</param>
          </param>
 </param>

        <!-- finally, we render the search in another FlashChart, and we throw in a JobProgressIndicator for good measure. -->
        <module name="Count of Duration"></module>

        <!-- We throw in a header so we can tell the user what they clicked on. -->
        <module name="SimpleResultsHeader">
          <param name="entityName">results</param>
          <param name="headerFormat">Trendchart=$click.value$ $time$</param>
        </module>
        <module name="HiddenChartFormatter">
          <param name="chart">line</param>
          <param name="primaryAxisTitle.text">Time</param>
          <param name="secondaryAxisTitle.text">events per second</param>
          <param name="legend.placement">none</param>
          <module name="FlashChart">
            <param name="width">100%</param>
            <param name="height">160px</param>
          </module>
        </module>
      </module>
      </module>
    </module>
  </module>
</module>

pls provide inputs ..about wheather the above code is correct and also about the error

Re: advanced xml charting

Ayn — Tue, 23 Oct 2012 12:25:16 GMT

Uh, well the error message says it really...you got a module in there called "Count of Duration":

 <module name="Count of Duration"/>

Like the error message says, there's no module called that, and I don't know really what you're trying to do there.

Re: advanced xml charting

bmacias84 — Wed, 24 Oct 2012 01:07:15 GMT

Here is a list of Modules. http://docs.splunk.com/Documentation/Splunk/latest/Developer/ModuleReference

topic Re: advanced xml charting in Dashboards & Visualizations

advanced xml charting

Re: advanced xml charting

Re: advanced xml charting