Dynamic charting.layout.splitSeries from checkbox Module

[cmak]

I was wondering if there is a way to make charting.layout.splitSeries parameter be dynamic. I tried methods such as http://splunk-base.splunk.com/answers/55625/telling-splunk-to-decide-which-type-of-chart-to-use-depe... which did not work for me.

I would like to have something like

<module name="HiddenChartFormatter">                                                                                                           <param name="charting.layout.splitSeries">$foo$</param>
<module name="FlashChart"/>
</module>

where $foo$ is either a true or false value. Hidden Chart formatter does not seem to recognize these tokens.

I also tried:

 <module name="PostProcess">
<param name="search">| eval chartType=$Split_Series$| rename chartType as "charting.layout.splitSeries"</param>
   <module name="ResultsValueSetter">
  <param name="fields">charting.layout.splitSeriese</param>                                                                                               <module name="PostProcess">
    <param name="search"> </param>            
                                                                                                   <module name="HiddenChartFormatter">

                                                                                                        <param name="charting.chart.showMarkers">true</param>
                                                                                                        <module name="FlashChart">
                                                                                                           <param name="height">600px</param>
                                                                                                        </module>
                                                                                                                                                                                                          </module>
                                                                                                                                                                                                     </module>
                                                                                                </module>

[sideview · Accepted solution]

Just create a token called $charting.layout.splitSeries$, with the right value. You can create it using a Checkbox module, or a Pulldown module, or a ResultsValueSetter. I think you came really close with your ResultsValueSetter attempt, except for a typo (splitSeriese has an extra e on the end there).

I think the easiest is just to use the Checkbox module to create it:

<module name="Checkbox">
  <param name="name">charting.layout.splitSeries</param>
  <param name="label">split series</param>
  <param name="onValue">True</param>
  <param name="offValue">False</param>

To quickly explain why this works -- all HiddenChartFormatter does is create a bunch of $foo$ tokens -- $charting.chart$ and $charting.chart.nullValueMode$ etc.. So you can create them yourself and they'll work just as well.

[cmak]

Great, this works. Yes, the extra "e" was a result of a lot of changing around and testing.