topic Passing Token values to Overlay field in the line chart in Dashboards & Visualizations

Passing Token values to Overlay field in the line chart

sanjai — Mon, 22 Apr 2024 06:02:31 GMT

Hi Splunkers,

I am working on creating a column line chart dashboard that shows database lattency . I'm encountering a issue where I'm trying to pass a token value to overlay options for line chart representation over a column chart. Here are things currently i have,

My Chart and My SPL query:

SPL:

index=development sourcetype=rwa_custom_function user_action=swmfs_test ds_file=*
| eval ds_file_path=ds_path."\\".ds_file
| chart avg(ms_per_block) as avg_processing_time_per_block over ds_file_path by machine
| appendcols
[search index=development sourcetype=rwa_custom_function user_action=swmfs_test ds_file=*
| eval ds_file_path=ds_path."\\".ds_file
| stats max(block_count) as total_blocks by ds_file_path]

I need to assign the overlay field value(avg_processing_time_per_block )from the line in SPL:

| chart avg(ms_per_block) as avg_processing_time_per_block over ds_file_path by machine

The reason I'm attempting to assign it as a token is that the avg_processing_time_per_block has dynamic values (sometimes it may be 10 or 12 machines data ).instead of rwmini and rwws01.

Column has total_blocks value

Or is there any ways to achieve this requirement?

Your thoughts on these are highly appreciated. Thank you in advance.

Sanjai

Re: Passing Token values to Overlay field in the line chart

ITWhisperer — Mon, 22 Apr 2024 07:56:20 GMT

You could have a separate (hidden) panel which generates the value of the token that you use to set the overlay fields for this panel

Re: Passing Token values to Overlay field in the line chart

sanjai — Mon, 22 Apr 2024 08:10:20 GMT

Hi @ITWhisperer
Thanks for reply ,

I understand ,
But correct me if i'm wrong

1.If i have a seperate hidden panel that gives my token value (avg_processing_time_per_block )

2.Then how can i assign the token $avg_processing_time_per_block$ value to overlay Fields

like these?
<option name="charting.chart.overlayFields">$avg_processing_time_per_block$ </option>

or
<option name="charting.chart.overlayFields">avg_processing_time_per_block </option>

if i gives these a token then line chart have a single line named avg_processing_time_per_block but the requirement is the avg_processing_time_per_block has dynamic value

My need is to how to assign the avg_processing_time_per_block value as token in charting.chart.overlayFields

thanks,

Re: Passing Token values to Overlay field in the line chart

ITWhisperer — Mon, 22 Apr 2024 08:24:16 GMT

As you are probably aware, the list of overlay fields is a comma-separated list of field name, so that's what you need in your token. You could try something like this

| stats values(machine) as avg_processing_time_per_block | eval avg_processing_time_per_block=mvjoin(avg_processing_time_per_block,",")

You would then set your token on the done block of the search, using this field from the (first) results row and use it in your display panel settings

<option name="charting.chart.overlayFields">$avg_processing_time_per_block$ </option>

Re: Passing Token values to Overlay field in the line chart

sanjai — Thu, 25 Apr 2024 07:24:33 GMT

Thanks @ITWhisperer , it worked