topic Repeat Line chart for multiple host selection in Dashboards & Visualizations

Repeat Line chart for multiple host selection

Sudhagar — Sat, 31 May 2025 13:12:08 GMT

I am trying to repeat line chart for multiple host selection. Each line chart should display the cpu usage for each selected hosts separately.

Here is my full source code in Dashboard studio.

{ "visualizations": { "viz_gsqlcpsd": { "type": "splunk.line", "dataSources": { "primary": "ds_xcdWhjuu" }, "title": "${selected_server:-All Servers} - CPU Usage %" } }, "inputs": { "input_VtWuBSik": { "options": { "items": [ { "label": "All", "value": "*" }, { "label": "host123", "value": "host123" }, { "label": "host1234", "value": "host1234" } ], "defaultValue": [ "*" ], "token": "selected_server" }, "title": "server", "type": "input.multiselect" }, "input_mj9iUMvw": { "options": { "defaultValue": "-15m,now", "token": "tr_hMOOrvcD" }, "title": "Time Range Input Title", "type": "input.timerange" } }, "layout": { "type": "grid", "globalInputs": [ "input_VtWuBSik", "input_mj9iUMvw" ], "options": { "backgroundColor": "transparent" }, "structure": [ { "item": "viz_gsqlcpsd", "type": "repeating", "repeatFor": { "input": "input_VtWuBSik" }, "position": { "x": 0, "y": 0, "w": 1200, "h": 400 } } ] }, "dataSources": { "ds_xcdWhjuu": { "type": "ds.search", "options": { "queryParameters": { "earliest": "-24h@h", "latest": "now" }, "query": "index=host_metrics measurement=cpu_time \r\n| search url IN($selected_server$) OR url=\"default_server\"\r\n| eval state_filter=if(match(state, \"^(idle|interrupt|nice|softirq|steal|system|user|wait)$\"), 1, 0)\r\n| where state_filter = 1\r\n| sort 0 _time url cpu state\r\n| streamstats current=f last(counter) as prev by url cpu state\r\n| eval delta = counter - prev\r\n| where delta >= 0\r\n| bin _time span=1m\r\n| eventstats sum(delta) as total by _time, url, cpu\r\n| eval percent = round((delta / total) * 100, 2)\r\n| eval url_state = url . \"_\" . state \r\n| timechart span=1m avg(percent) by url_state\r\n| foreach * [eval <<FIELD>> = round('<<FIELD>>', 2)]" }, "name": "CPU_Util_Search_1" } }, "title": "Test_Multi Line chart" }

Re: Repeat Line chart for multiple host selection

kiran_panchavat — Sat, 31 May 2025 15:17:57 GMT

@Sudhagar

Are you looking something like this? Attached image. I created using some dummy data with static values.

{

    "title": "Static CPU Usage Charts per Host",

    "visualizations": {

        "viz_host123": {

            "dataSources": {

                "primary": "ds_host123"

            },

            "options": {

                "legendPlacement": "right",

                "xAxisTitle": "Time",

                "yAxisTitle": "CPU Usage (%)"

            },

            "title": "host123 - CPU Usage %",

            "type": "splunk.line"

        },

        "viz_host456": {

            "dataSources": {

                "primary": "ds_host456"

            },

            "options": {

                "legendPlacement": "right",

                "xAxisTitle": "Time",

                "yAxisTitle": "CPU Usage (%)"

            },

            "title": "host456 - CPU Usage %",

            "type": "splunk.line"

        },

        "viz_host789": {

            "dataSources": {

                "primary": "ds_host789"

            },

            "options": {

                "legendPlacement": "right",

                "xAxisTitle": "Time",

                "yAxisTitle": "CPU Usage (%)"

            },

            "title": "host789 - CPU Usage %",

            "type": "splunk.line"

        }

    },

    "dataSources": {

        "ds_host123": {

            "options": {

                "query": "| makeresults count=10\n| streamstats count as row\n| eval _time = relative_time(now(), \"-\" . (10 - row) . \"m\")\n| eval host=\"host123\"\n| eval state_list=split(\"user,system,idle\", \",\")\n| mvexpand state_list\n| eval state=state_list\n| eval percent=case(state==\"user\",20+random()%10,state==\"system\",10+random()%5,state==\"idle\",70+random()%10)\n| eval host_state=host.\"_\".state\n| timechart span=1m avg(percent) by host_state",

                "queryParameters": {

                    "earliest": "-30m",

                    "latest": "now"

                }

            },

            "type": "ds.search"

        },

        "ds_host456": {

            "options": {

                "query": "| makeresults count=10\n| streamstats count as row\n| eval _time = relative_time(now(), \"-\" . (10 - row) . \"m\")\n| eval host=\"host456\"\n| eval state_list=split(\"user,system,idle\", \",\")\n| mvexpand state_list\n| eval state=state_list\n| eval percent=case(state==\"user\",20+random()%10,state==\"system\",10+random()%5,state==\"idle\",70+random()%10)\n| eval host_state=host.\"_\".state\n| timechart span=1m avg(percent) by host_state",

                "queryParameters": {

                    "earliest": "-30m",

                    "latest": "now"

                }

            },

            "type": "ds.search"

        },

        "ds_host789": {

            "options": {

                "query": "| makeresults count=10\n| streamstats count as row\n| eval _time = relative_time(now(), \"-\" . (10 - row) . \"m\")\n| eval host=\"host789\"\n| eval state_list=split(\"user,system,idle\", \",\")\n| mvexpand state_list\n| eval state=state_list\n| eval percent=case(state==\"user\",20+random()%10,state==\"system\",10+random()%5,state==\"idle\",70+random()%10)\n| eval host_state=host.\"_\".state\n| timechart span=1m avg(percent) by host_state",

                "queryParameters": {

                    "earliest": "-30m",

                    "latest": "now"

                }

            },

            "type": "ds.search"

        }

    },

    "layout": {

        "layoutDefinitions": {

            "layout_1": {

                "options": {

                    "backgroundColor": "transparent"

                },

                "structure": [

                    {

                        "item": "viz_host123",

                        "position": {

                            "h": 400,

                            "w": 1200,

                            "x": 0,

                            "y": 0

                        },

                        "type": "block"

                    },

                    {

                        "item": "viz_host456",

                        "position": {

                            "h": 400,

                            "w": 1200,

                            "x": 0,

                            "y": 400

                        },

                        "type": "block"

                    },

                    {

                        "item": "viz_host789",

                        "position": {

                            "h": 400,

                            "w": 1200,

                            "x": 0,

                            "y": 800

                        },

                        "type": "block"

                    }

                ],

                "type": "grid"

            }

        },

        "tabs": {

            "items": [

                {

                    "label": "New tab",

                    "layoutId": "layout_1"

                }

            ]

        }

    }

}

Re: Repeat Line chart for multiple host selection

Sudhagar — Sat, 31 May 2025 16:04:37 GMT

{ "visualizations": { "viz_gsqlcpsd": { "type": "splunk.line", "dataSources": { "primary": "ds_xcdWhjuu" }, "title": "${selected_server:-All Servers} - CPU Usage %" } }, "inputs": { "input_IAwTOhNf": { "options": { "items": [], "token": "selected_server", "defaultValue": "" }, "title": "Server Name", "type": "input.multiselect", "dataSources": { "primary": "ds_dIoNDOrf" }, "showProgressBar": true, "showLastUpdated": true, "context": {} }, "input_mj9iUMvw": { "options": { "defaultValue": "-15m,now", "token": "tr_hMOOrvcD" }, "title": "Time Range Input Title", "type": "input.timerange" } }, "layout": { "type": "grid", "globalInputs": [ "input_VtWuBSik", "input_mj9iUMvw" ], "options": { "backgroundColor": "transparent" }, "structure": [ { "item": "viz_gsqlcpsd", "type": "repeating", "repeatFor": { "input": "input_VtWuBSik" }, "position": { "x": 0, "y": 0, "w": 1200, "h": 400 } } ] }, "dataSources": { "ds_xcdWhjuu": { "type": "ds.search", "options": { "queryParameters": { "earliest": "-24h@h", "latest": "now" }, "query": "index=cto_epe_observability sourcetype=otel_host_metrics measurement=otel_system_cpu_time \r\n| search url IN($selected_server$) OR url=\"default_server\"\r\n| eval state_filter=if(match(state, \"^(idle|interrupt|nice|softirq|steal|system|user|wait)$\"), 1, 0)\r\n| where state_filter = 1\r\n| sort 0 _time url cpu state\r\n| streamstats current=f last(counter) as prev by url cpu state\r\n| eval delta = counter - prev\r\n| where delta >= 0\r\n| bin _time span=1m\r\n| eventstats sum(delta) as total by _time, url, cpu\r\n| eval percent = round((delta / total) * 100, 2)\r\n| eval url_state = url . \"_\" . state \r\n| timechart span=1m avg(percent) by url_state\r\n| foreach * [eval <<FIELD>> = round('<<FIELD>>', 2)]" }, "name": "CPU_Util_Search_1" } }, "ds_dIoNDOrf": { "type": "ds.search", "options": { "query": "index=server | dedup server|table server", "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } }, "name": "Server_Search_1" }, "title": "Test_Multi Line chart" }

@kiran_panchavat Thanks for the quick response. Your understanding is right.

I believe your code is static , but I want dynamic according to the query results in multi select. Here's my full code

Re: Repeat Line chart for multiple host selection

somesoni2 — Mon, 02 Jun 2025 18:00:59 GMT

You can try the `showSplitSeries` option in the the dashboard studio to show each line/series as it's own chart. See this runanywhere sample dashboard:

{ "title": "Test_Dynamic_Charting", "description": "", "inputs": { "input_global_trp": { "options": { "defaultValue": "-24h@h,now", "token": "global_time" }, "title": "Global Time Range", "type": "input.timerange" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } } }, "visualizations": { "viz_5sPrf0wX": { "dataSources": { "primary": "ds_jq4P4CeS" }, "options": { "showIndependentYRanges": true, "showSplitSeries": true, "yAxisMajorTickSize": 4 }, "type": "splunk.line" } }, "dataSources": { "ds_jq4P4CeS": { "name": "Search_1", "options": { "query": "index=_internal \n| eval sourcetype=sourcetype.\"##\".log_level\n| timechart count by sourcetype" }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_global_trp" ], "layoutDefinitions": { "layout_1": { "options": { "display": "auto", "height": 960, "width": 1440 }, "structure": [ { "item": "viz_5sPrf0wX", "position": { "h": 960, "w": 1240, "x": 0, "y": 0 }, "type": "block" } ], "type": "absolute" } }, "options": {}, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } } }