topic How to create charts for each host dynamically in a dashboard using simple xml? in Dashboards & Visualizations

How to create charts for each host dynamically in a dashboard using simple xml?

rodrigorenie — Mon, 02 Feb 2015 12:30:55 GMT

Hello everyone.

I have a very simple search which I use to create a 100% Stack Bar showing the availability of a specific host:

host=myhostname index=availability sourcetype="avail" | stats avg(unavail) AS Unavailability, avg(avail) AS Availability by host

I know I could just replace the "myhostname" with "*" and create one graph with several host entries displaying their availability, but what I'd like to do is create one graph for each host on a Dashboard dynamically, that is, if a new server starts to send logs do splunk, this dashboard will automatically create a new graph containing it's availability.

And I need to do this using Simple XML (if possible), my access to our Splunk server is currently limited. So far, I found the "depends" property which I can use with the "chart" element, which means that this chart will only be displayed if the tokens in the "depends" property actually exists, but I could figure out a way to use it.

Any ideas?

Thanks!

Re: How to create charts for each host dynamically in a dashboard using simple xml?

wpreston — Mon, 02 Feb 2015 19:49:26 GMT

Have you tried using multi-series mode? Just set multi-series mode to "yes" in your chart properties and Splunk will make a different chart for each of the field you are splitting by (host in your case). This won't give each chart its own panel, but it will give a chart for each host. Is that close enough?

Re: How to create charts for each host dynamically in a dashboard using simple xml?

wpreston — Mon, 02 Feb 2015 19:54:22 GMT

Oops, doesn't quite work they way I thought. Disregard this answer.