topic Re: Single search in multiple charts in Splunk Search

Single search in multiple charts

gimbil — Mon, 04 Nov 2013 22:46:44 GMT

Hi All,

I have a search such as
search logs | ... |timchart count(eval(X="a")), count(eval(X="b)), count(eval(X="c")), …

Is there any way I can show the result, i.e., count of "a","b","c" and so one each on one chart in simple xml?

Thanks

Re: Single search in multiple charts

somesoni2 — Tue, 05 Nov 2013 02:17:53 GMT

You can try searchTemplate and searchPostProcess modules of simple xml as follow:-

 <form>
 <label>PostProcess Example</label>  
  <!-- Search that returns all of the data that requested by subsequent panels -->
  <searchTemplate>
   search logs | ... |...
  </searchTemplate>

  <row>
          <chart>
            <title>Count of A over time</title>
            <searchPostProcess>timechart  count(eval(X="a"))</searchPostProcess>
             <option name="height">300px</option>
             <option name="charting.chart">area</option>
             <option name="charting.chart.stackMode">stacked</option>
          </chart>
  </row>  
  <row>
          <chart>
            <title>Count of B over time</title>
            <searchPostProcess>timechart  count(eval(X="b"))</searchPostProcess>
             <option name="height">300px</option>
             <option name="charting.chart">area</option>
             <option name="charting.chart.stackMode">stacked</option>
          </chart>
  </row> 
  <row>
          <chart>
            <title>Count of C over time</title>
            <searchPostProcess>timechart  count(eval(X="c"))</searchPostProcess>
             <option name="height">300px</option>
             <option name="charting.chart">area</option>
             <option name="charting.chart.stackMode">stacked</option>
          </chart>
  </row> 
</form>

Re: Single search in multiple charts

yong_ly — Tue, 05 Nov 2013 03:46:54 GMT

you could build a form with that basic root search and create three different panels charts subsearches or a saved search.

Since 'chart' represents on container and panel, I think you'd need to specific a search for it..

http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML

But since you're working in XML, it's relatively easy to just copy and modify the same container..