topic Re: TimeRangePicker Charting Question in Splunk Search

TimeRangePicker Charting Question

Ant1D — Tue, 14 Sep 2010 23:33:16 GMT

Hey,

I have written the following advanced dashboard that allows me to view results in a simple table based on what option I choose in my timerangepicker:

<view template="dashboard.html">

<label>Test Dashboard</label>

<module name="AccountBar" layoutPanel="navigationHeader"/>

<module name="AppBar" layoutPanel="navigationHeader"/>

<module name="Message" layoutPanel="messaging">

<param name="filter">*</param>

<param name="clearOnJobDispatch">False</param>

<param name="maxSize">1</param>

</module>

<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="It will work...eventually" autoRun="True">

<param name="savedSearch">crashes Dev</param>

 <module name="TimeRangePicker">

         <param name="searchWhenChanged">True</param>

         <param name="default">Last 24 hours</param>

     <module name="SimpleResultsTable">

     </module>

 </module>

How can I modify this code so that I can still use the timerangepicker but now have the results displayed in a bar chart and not a SimpleResultsTable?

Also, how would I be able to specify what values I add to the x and y axis?

Re: TimeRangePicker Charting Question

ftk — Wed, 15 Sep 2010 00:32:05 GMT

You will want to use the FlashChart module instead of the SimpleResultsTable module. Then use the HiddenChartFormatter to format the chart. You can use the chart param to specify a bar chart.

Take a look at the other chart formatting modules in the module reference and you will see there is a plethora of options to customize your charts.

Re: TimeRangePicker Charting Question

sideview — Wed, 15 Sep 2010 00:48:01 GMT

replace your SimpleResultsTable with this:

<module name="HiddenChartFormatter">
  <param name="charting.chart">bar</param>
  <module name="FlashChart">
  </module>
</module>

Check out the module reference page on splunk.com, and you can always go to http:///en-US/modules in your browser, on any splunk install to read the autogenerated docs for the modules and params they have.

(and you can go to /en-US/info for a couple other useful things to.)

And even better than all this would be to download the "UI examples for 4.1" app from splunkbase. If you're more into learning from hands-on examples you might find it a better resource than the docs. It has 50 or 60 examples at differing levels and in different areas and you can tweak them and learn by experimenting.

Re: TimeRangePicker Charting Question

Ant1D — Wed, 15 Sep 2010 16:12:49 GMT

Thanks for the info ftk. I wish there were some examples to go with all those chart options 😄

Re: TimeRangePicker Charting Question

Ant1D — Wed, 15 Sep 2010 16:15:19 GMT

Hey Nick, thanks for the help and thanks for the examples also 😄 I'm sure they will be handy. It would be great to get some more examples in the documentation.