https://community.splunk.com/t5/Dashboards-Visualizations/Customizing-Rather-configuring-dashboard-logic/m-p/144639#M8752 <P><STRONG>Setup</STRONG></P> <P>An app that shows how certain function of business is doing during an event. I've Splunk 6.2 dashboard to show about 4~6 panels showing different metrics including what we call as time between states ...</P> <P>These are calculated as time between different states of an order. </P> <P><STRONG>Need</STRONG></P> <P>Assume there are five states create, queue , submit, assign, confirm. </P> <P>One client might require to combine create + queue as one state , while other may require create and queue to be different states of an order..</P> <P>Meaning, client 1 may consider queue time as assign_timestamp - min(create_timestamp, queue_timestamp) ...client 2 might consider queue time as (quue_timestamp - create_timestamp)</P> <P><STRONG>Question</STRONG></P> <OL> <LI>What is the best way to achieve such functionality such that I can configure these calculations as opposed to putting in queries or macros ...for example, can I create an external source of these states and calculations, and refer it in Splunk? </LI> </OL> <P>If so How ?</P> <OL> <LI>how to achieve the functionality such that when a third client comes with some different need, I can manipulate this external source with sequence of states and/or calculations </LI> </OL> <P>Thanks, ronak</P> Mon, 28 Sep 2020 18:57:44 GMT ronak 2020-09-28T18:57:44Z https://community.splunk.com/t5/Dashboards-Visualizations/Customizing-Rather-configuring-dashboard-logic/m-p/144639#M8752 <P><STRONG>Setup</STRONG></P> <P>An app that shows how certain function of business is doing during an event. I've Splunk 6.2 dashboard to show about 4~6 panels showing different metrics including what we call as time between states ...</P> <P>These are calculated as time between different states of an order. </P> <P><STRONG>Need</STRONG></P> <P>Assume there are five states create, queue , submit, assign, confirm. </P> <P>One client might require to combine create + queue as one state , while other may require create and queue to be different states of an order..</P> <P>Meaning, client 1 may consider queue time as assign_timestamp - min(create_timestamp, queue_timestamp) ...client 2 might consider queue time as (quue_timestamp - create_timestamp)</P> <P><STRONG>Question</STRONG></P> <OL> <LI>What is the best way to achieve such functionality such that I can configure these calculations as opposed to putting in queries or macros ...for example, can I create an external source of these states and calculations, and refer it in Splunk? </LI> </OL> <P>If so How ?</P> <OL> <LI>how to achieve the functionality such that when a third client comes with some different need, I can manipulate this external source with sequence of states and/or calculations </LI> </OL> <P>Thanks, ronak</P> Mon, 28 Sep 2020 18:57:44 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Customizing-Rather-configuring-dashboard-logic/m-p/144639#M8752 ronak 2020-09-28T18:57:44Z https://community.splunk.com/t5/Dashboards-Visualizations/Customizing-Rather-configuring-dashboard-logic/m-p/144640#M8753 <P>I've monkeyed around with having a lookup that maps groups to specific alert to thresholds - something like</P> <P>alert1,group1,5<BR /> alert1,group2,4<BR /> alert1,group3,10</P> <P>What you are proposing potentially could be done in a lookup but my mind slides more toward a complex case statement like</P> <PRE><CODE>...| eval queue_time = case(group=client1, assign_timestamp - min(create_timestamp, queue_timestamp), group=client2, quue_timestamp - create_timestamp, 1=1, "fix me") | .. </CODE></PRE> <P>Of course that doesn't really fit what you are looking for; conditions not being in the query or a macro. Of course if you have it in a macro it makes it much easier to update and keep track of /shrug.</P> Sun, 15 Feb 2015 23:35:27 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Customizing-Rather-configuring-dashboard-logic/m-p/144640#M8753 Runals 2015-02-15T23:35:27Z