All Apps and Add-ons

Dynamic charting.layout.splitSeries from checkbox Module

cmak
Contributor

I was wondering if there is a way to make charting.layout.splitSeries parameter be dynamic. I tried methods such as http://splunk-base.splunk.com/answers/55625/telling-splunk-to-decide-which-type-of-chart-to-use-depe... which did not work for me.

I would like to have something like

<module name="HiddenChartFormatter">                                                                                                           <param name="charting.layout.splitSeries">$foo$</param>
<module name="FlashChart"/>
</module>

where $foo$ is either a true or false value. Hidden Chart formatter does not seem to recognize these tokens.

I also tried:

 <module name="PostProcess">
<param name="search">| eval chartType=$Split_Series$| rename chartType as "charting.layout.splitSeries"</param>
   <module name="ResultsValueSetter">
  <param name="fields">charting.layout.splitSeriese</param>                                                                                               <module name="PostProcess">
    <param name="search"> </param>            
                                                                                                   <module name="HiddenChartFormatter">

                                                                                                        <param name="charting.chart.showMarkers">true</param>
                                                                                                        <module name="FlashChart">
                                                                                                           <param name="height">600px</param>
                                                                                                        </module>
                                                                                                                                                                                                          </module>
                                                                                                                                                                                                     </module>
                                                                                                </module>
1 Solution

sideview
SplunkTrust
SplunkTrust

Just create a token called $charting.layout.splitSeries$, with the right value. You can create it using a Checkbox module, or a Pulldown module, or a ResultsValueSetter. I think you came really close with your ResultsValueSetter attempt, except for a typo (splitSeriese has an extra e on the end there).

I think the easiest is just to use the Checkbox module to create it:

<module name="Checkbox">
  <param name="name">charting.layout.splitSeries</param>
  <param name="label">split series</param>
  <param name="onValue">True</param>
  <param name="offValue">False</param>

To quickly explain why this works -- all HiddenChartFormatter does is create a bunch of $foo$ tokens -- $charting.chart$ and $charting.chart.nullValueMode$ etc.. So you can create them yourself and they'll work just as well.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Just create a token called $charting.layout.splitSeries$, with the right value. You can create it using a Checkbox module, or a Pulldown module, or a ResultsValueSetter. I think you came really close with your ResultsValueSetter attempt, except for a typo (splitSeriese has an extra e on the end there).

I think the easiest is just to use the Checkbox module to create it:

<module name="Checkbox">
  <param name="name">charting.layout.splitSeries</param>
  <param name="label">split series</param>
  <param name="onValue">True</param>
  <param name="offValue">False</param>

To quickly explain why this works -- all HiddenChartFormatter does is create a bunch of $foo$ tokens -- $charting.chart$ and $charting.chart.nullValueMode$ etc.. So you can create them yourself and they'll work just as well.

cmak
Contributor

Great, this works. Yes, the extra "e" was a result of a lot of changing around and testing.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...