topic Re: Force query result to display as chart in Dashboards & Visualizations

Force query result to display as chart

travis_bear — Mon, 28 Oct 2013 16:06:31 GMT

I have the following query in Splunk 5:

index=summary
report=hw_use_by_jobs 
orig_host="my_host" |
chart 
   p50(PercentProcessorTime_max) as "p50 CPU", 
   stdev(PercentProcessorTime_max) as "CPU stdev",
   count as DataPoints
   over ConcurrentTasks |
eventstats sum(DataPoints) as Total_DataPoints  |
eval "Percent of Time"=100*DataPoints/Total_DataPoints | 
fields "ConcurrentTasks" "Percent of Time"  "p50 CPU"

The output of this query is a table of numeric data, with a UI option I can click to display the results as a graphical chart. Is there any way I can specify in the query itself that I want the data to display initially as a chart instead of as a table?

My goal is to stick this chart into a view, so if there is a better approach to doing this in the query itself, I'm open to that as well.

Re: Force query result to display as chart

somesoni2 — Mon, 28 Oct 2013 18:52:57 GMT

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table).

Re: Force query result to display as chart

travis_bear — Mon, 28 Oct 2013 19:36:50 GMT

@somesoni -- That's helpful. If you submit your comment as an answer, I will accept it. If you include a simple xml example, I will upvote it as well.

Re: Force query result to display as chart

somesoni2 — Mon, 28 Oct 2013 23:04:19 GMT

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table). Simple xml example"-

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>IndexStats</label>
 <!-- Place panels within rows -->
  <row>
    <table>
      <title>Top Sourcetypes (Last 24 hours)</title>
      <!-- A search powers the panel -->
      <searchString>
       ****You search query****
      </searchString>

      <!-- Specify a time range for the search -->
      <earliestTime>-24h@h</earliestTime>
      <latestTime>now</latestTime>

      <!-- Use options to further define how to display result data -->
      <option name="wrap">true</option>
      <option name="rowNumbers">true</option>
    </table>
  </row>
  <row>
    <chart>
      <title>PerIndexThruputChart</title>
       <searchString>
       ****You search query****
      </searchString>
  <!-- Specify a time range for the search -->
  <earliestTime>-24h@h</earliestTime>
  <latestTime>now</latestTime>

  <!-- Use options to further define how to display result data -->
  <option name="charting.chart">bar</option>
</chart>

Re: Force query result to display as chart

travis_bear — Mon, 28 Oct 2013 23:38:39 GMT

Thank you that was helpful!