topic Re: Auto scale up/down of visualization panel in splunk dashboard in Dashboards & Visualizations

Auto scale up/down of visualization panel in splunk dashboard

SureshkumarD — Mon, 01 Apr 2024 20:02:10 GMT

Hi Team,

I extracted each webpage details which is dynamic based on the time range for one of our application. Is it possible to auto scale up/down the visualization panel (like single value) in the splunk dashboard based on the output of the splunk query? For example, if suppose dev team added/removed the webpage or functionality, the visualization panel should be created/deleted automatically. Thank you in advance.

Re: Auto scale up/down of visualization panel in splunk dashboard

ITWhisperer — Mon, 01 Apr 2024 22:12:48 GMT

This question is too vague - yes, some auto-scaling can be done under certain circumstances, but whether is is possible for your usecase is yet to be determined. Perhaps you could share some sample events, the searches you are using and your current dashboard designs. Also, include what you have tried so far, and a mock up of what you would like it to look like (if possible).

Re: Auto scale up/down of visualization panel in splunk dashboard

SureshkumarD — Tue, 02 Apr 2024 17:08:41 GMT

Hi,

Here is the query and the results. Visualization panels should get created/deleted automatically depends on the rows under the Page column.

index="*" appID="*" environment=* tags="*" stepName="*" status=FAILED | rex field=stepName "^(?<Page>[^\:]+)" | rex field=stepName "^\'(?<Page>[^\'\:]+)" | rex field=stepName "\:(?P<action>.*)" | eval Page=lower(Page) | stats count(scenario) as "Number of Scenarios" by Page | table Page, "Number of Scenarios"

I created the created single value visualization panel manually based on the rows, but if the rows are decreased dynamically, I could see N/A in most of the visualization panels. So, auto-scaling of visualization panel is needed in this scenario.

Re: Auto scale up/down of visualization panel in splunk dashboard

ITWhisperer — Tue, 02 Apr 2024 17:02:29 GMT

Would trellis layout work for you? Note that this is limited to 20 per page in Classic / SimpleXML dashboards, but Studio allows you to set the number per page.

Re: Auto scale up/down of visualization panel in splunk dashboard

SureshkumarD — Tue, 02 Apr 2024 18:52:56 GMT

Hi,

Thank you for the prompt response. Trellis layout can be one of the options. However, for example, If I click on DB, then it should redirect to the separate visualization where we need to view the in-depth details only for DB and not for MEMBERDASHBOARD or TASKEDIT. Is it possible, please let me know.

Re: Auto scale up/down of visualization panel in splunk dashboard

ITWhisperer — Tue, 02 Apr 2024 22:16:23 GMT

Probably - the token you could try to use in the drilldown is $trellis.value$

Re: Auto scale up/down of visualization panel in splunk dashboard

SureshkumarD — Mon, 08 Apr 2024 12:58:47 GMT

Hi @ITWhisperer ,

I tried the token, but it is not working as expected. Could you please assist on this?

Here is the redirection destination dashboard below.

Re: Auto scale up/down of visualization panel in splunk dashboard

ITWhisperer — Mon, 08 Apr 2024 13:03:33 GMT

Please share the source of your dashboard in a code block so we can see what you have attempted.

Re: Auto scale up/down of visualization panel in splunk dashboard

SureshkumarD — Mon, 08 Apr 2024 14:01:19 GMT

@ITWhisperer ,

Here is the Data source for the source dashboard.

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=FAILED | rex field=stepName "^(?<Page>[^\:]+)" | rex field=stepName "^\'(?<Page>[^\'\:]+)" | eval Page=upper(Page) | stats count(scenario) as "Number of Scenarios" by Page | sort - "Number of Scenarios"

Here is the Data source for the destination dashboard.

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" scenario="$scenariosTok$" status=FAILED | rex field=stepName "^(?<Page>[^\:]+)" | rex field=stepName "^\'(?<Page>[^\'\:]+)" | rex field=stepName "\:(?P<action>.*)" | search Page="$stepTok$" | eval Page=upper(Page) | stats list(action) as Actions by Page,scenario,error_log | rename Page as "Page(Step)",scenario as Scenarios,error_log as "Exceptions" | table Page(Step),Scenarios,Actions,Exceptions

Finally, Here are the data sources for the two drop downs added in the destination dashboard.

Scenarios dropdown

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" scenario="*" status=FAILED | rex field=stepName "^(?<Page>[^\:]+)" | rex field=stepName "^\'(?<Page>[^\'\:]+)" | search Page="$stepTok$" | stats count by scenario

Page dropdown

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=FAILED | rex field=stepName "^(?<Page>[^\:]+)" | rex field=stepName "^\'(?<Page>[^\'\:]+)" | search scenario="$scenariosTok$" | stats count by Page

Re: Auto scale up/down of visualization panel in splunk dashboard

ITWhisperer — Mon, 08 Apr 2024 13:37:06 GMT

Please share the source code of your dashboard

Re: Auto scale up/down of visualization panel in splunk dashboard

SureshkumarD — Mon, 08 Apr 2024 15:52:35 GMT

Here is the source code for destination dashboard

{ "dataSources": { "ds_PxUp5pVa": { "type": "ds.search", "options": { "query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" scenario=\"$scenariosTok$\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| rex field=stepName \"\\:(?P<action>.*)\"\r\n| search Page=\"$stepTok$\"\r\n| eval Page=upper(Page)\r\n| stats list(action) as Actions by Page,scenario,error_log\r\n| rename Page as \"Page(Step)\",scenario as Scenarios,error_log as \"Exceptions\"\r\n| table Page(Step),Scenarios,Actions,Exceptions", "queryParameters": {} }, "name": "APP-xxx_THAAProperxxx_regressionactions" }, "ds_GTBvsceW": { "type": "ds.search", "options": { "query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| search scenario=\"$scenariosTok$\" \r\n| stats count by Page" }, "name": "steps" }, "ds_0peRb3iY": { "type": "ds.search", "options": { "query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" scenario=\"*\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| search Page=\"$stepTok$\"\r\n| stats count by scenario", "queryParameters": {} }, "name": "Scenarios" } }, "visualizations": { "viz_Qido8tOl": { "type": "splunk.table", "options": { "count": 100, "dataOverlayMode": "none", "drilldown": "none", "showInternalFields": false, "backgroundColor": "#FAF9F6", "tableFormat": { "rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByBackgroundColor)", "headerBackgroundColor": "> backgroundColor | setColorChannel(tableHeaderBackgroundColorConfig)", "rowColors": "> rowBackgroundColors | maxContrast(tableRowColorMaxContrast)", "headerColor": "> headerBackgroundColor | maxContrast(tableRowColorMaxContrast)" } }, "dataSources": { "primary": "ds_PxUp5pVa" }, "title": "Regression Results with Actions & Error Details" }, "viz_wtfZ8Urm": { "type": "splunk.markdown", "options": { "markdown": "***xxx***", "fontColor": "#FAF9F6", "fontSize": "custom", "customFontSize": 34, "fontFamily": "Arial" } }, "viz_wkircOE3": { "type": "splunk.rectangle", "options": { "fillColor": "#FAF9F6", "strokeColor": "#000000" } }, "viz_KR6lYV6G": { "type": "splunk.rectangle", "options": { "fillColor": "#FAF9F6" } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-7d@h,now" }, "title": "Global Time Range" }, "input_7pdCBCBD": { "options": { "items": ">frame(label, value) | prepend(formattedStatics) | objects()", "defaultValue": "*", "token": "scenariosTok" }, "title": "Scenarios", "type": "input.dropdown", "dataSources": { "primary": "ds_0peRb3iY" }, "context": { "formattedConfig": { "number": { "prefix": "" } }, "formattedStatics": ">statics | formatByType(formattedConfig)", "statics": [ [ "All" ], [ "*" ] ], "label": ">primary | seriesByName(\"scenario\") | renameSeries(\"label\") | formatByType(formattedConfig)", "value": ">primary | seriesByName(\"scenario\") | renameSeries(\"value\") | formatByType(formattedConfig)" } }, "input_mv3itLP9": { "options": { "items": ">frame(label, value) | prepend(formattedStatics) | objects()", "defaultValue": "*", "token": "stepTok" }, "title": "Page(Steps)", "type": "input.dropdown", "dataSources": { "primary": "ds_GTBvsceW" }, "context": { "formattedConfig": { "number": { "prefix": "" } }, "formattedStatics": ">statics | formatByType(formattedConfig)", "statics": [ [ "All" ], [ "*" ] ], "label": ">primary | seriesByName(\"Page\") | renameSeries(\"label\") | formatByType(formattedConfig)", "value": ">primary | seriesByName(\"Page\") | renameSeries(\"value\") | formatByType(formattedConfig)" } } }, "layout": { "type": "absolute", "options": { "width": 2000, "height": 2500, "display": "auto", "backgroundColor": "#294e70" }, "structure": [ { "item": "viz_wkircOE3", "type": "block", "position": { "x": 10, "y": 50, "w": 1980, "h": 1810 } }, { "item": "viz_wtfZ8Urm", "type": "block", "position": { "x": 10, "y": 10, "w": 1580, "h": 50 } }, { "item": "viz_KR6lYV6G", "type": "block", "position": { "x": 20, "y": 60, "w": 1950, "h": 510 } }, { "item": "viz_Qido8tOl", "type": "block", "position": { "x": 30, "y": 70, "w": 1930, "h": 490 } } ], "globalInputs": [ "input_global_trp", "input_7pdCBCBD", "input_mv3itLP9" ] }, "title": "xxx", "description": "", "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" }, "refreshType": "delay", "refresh": "5m" } } } } }

Re: Auto scale up/down of visualization panel in splunk dashboard

ITWhisperer — Mon, 08 Apr 2024 16:07:26 GMT

This source does not seem to match the visualisation you have shown earlier. Are you using a trellis of singles or not?

Re: Auto scale up/down of visualization panel in splunk dashboard

SureshkumarD — Tue, 09 Apr 2024 14:33:27 GMT

Hi @ITWhisperer ,

Source code has huge lines so I am unable to paste it or attach as a file. Kindly advise.

Re: Auto scale up/down of visualization panel in splunk dashboard

ITWhisperer — Tue, 09 Apr 2024 14:59:01 GMT

It doesn't have to be whole dashboard, but it should at least match the visualisation you shared earlier, or, if it doesn't then share the part that isn't working for you (so we can try and test it, or our solutions, for you).

Re: Auto scale up/down of visualization panel in splunk dashboard

SureshkumarD — Tue, 09 Apr 2024 15:22:29 GMT

@ITWhisperer

Here is the source code of trellis single value visualization

{

"type": "splunk.singlevalue",

"options": {

"numberPrecision": 0,

"sparklineDisplay": "below",

"trendDisplay": "absolute",

"unitPosition": "after",

"shouldUseThousandSeparators": true,

"trellisMinColumnWidth": 120,

"trellisRowHeight": 68,

"majorValue": "> sparklineValues | lastPoint()",

"trendValue": "> sparklineValues | delta(-2)",

"sparklineValues": "> primary | seriesByName('Number of Scenarios')",

"trellisSplitBy": "Page",

"splitByLayout": "trellis",

"trellisPageCount": 1000,

"backgroundColor": "#d41f1f",

"majorColor": "#FAF9F6",

"trellisBackgroundColor": "#FAF9F6"

"context": {

"convertedColorRange": [

{

"from": 100,

"value": "#dc4e41"

{

"from": 70,

"to": 100,

"value": "#f1813f"

{

"from": 30,

"to": 70,

"value": "#f8be34"

{

"from": 0,

"to": 30,

"value": "#0877a6"

{

"to": 0,

"value": "#53a051"

}

]

"dataSources": {

"primary": "ds_P7P9WCoL_ds_TheWXmJx_ds_ionW1KZM"

"eventHandlers": [

{

"type": "drilldown.linkToDashboard",

"options": {

"app": "search",

"dashboard": "reliability_layer_3_insight_application_dashboard__thaa_proper",

"newTab": true,

"tokens": []

}

{

"type": "drilldown.setToken",

"options": {

"tokens": [

{

"token": "stepTok",

"key": "trellis.value"

}

]

}

"showProgressBar": false,

"showLastUpdated": false,

"hideWhenNoData": false

}

Here is the datasource used for the this visualization.

index="xxx" appID="APP-xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=PASSED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| eval Page=upper(Page)
| stats count(scenario) as "Number of Scenarios" by Page
| sort - "Number of Scenarios"

Re: Auto scale up/down of visualization panel in splunk dashboard

SureshkumarD — Sat, 13 Apr 2024 04:18:26 GMT

Hi @ITWhisperer ,

Could you please provide an update on this request? Thank you,

Re: Auto scale up/down of visualization panel in splunk dashboard

SureshkumarD — Thu, 18 Apr 2024 19:47:34 GMT

Can someone assist on this request please? Thank you.