I was wondering if there is a way to make charting.layout.splitSeries parameter be dynamic. I tried methods such as http://splunk-base.splunk.com/answers/55625/telling-splunk-to-decide-which-type-of-chart-to-use-depe... which did not work for me.
I would like to have something like
<module name="HiddenChartFormatter"> <param name="charting.layout.splitSeries">$foo$</param>
<module name="FlashChart"/>
</module>
where $foo$ is either a true or false value. Hidden Chart formatter does not seem to recognize these tokens.
I also tried:
<module name="PostProcess">
<param name="search">| eval chartType=$Split_Series$| rename chartType as "charting.layout.splitSeries"</param>
<module name="ResultsValueSetter">
<param name="fields">charting.layout.splitSeriese</param> <module name="PostProcess">
<param name="search"> </param>
<module name="HiddenChartFormatter">
<param name="charting.chart.showMarkers">true</param>
<module name="FlashChart">
<param name="height">600px</param>
</module>
</module>
</module>
</module>
Just create a token called $charting.layout.splitSeries$
, with the right value. You can create it using a Checkbox module, or a Pulldown module, or a ResultsValueSetter. I think you came really close with your ResultsValueSetter attempt, except for a typo (splitSeriese
has an extra e on the end there).
I think the easiest is just to use the Checkbox module to create it:
<module name="Checkbox">
<param name="name">charting.layout.splitSeries</param>
<param name="label">split series</param>
<param name="onValue">True</param>
<param name="offValue">False</param>
To quickly explain why this works -- all HiddenChartFormatter does is create a bunch of $foo$ tokens -- $charting.chart$ and $charting.chart.nullValueMode$ etc.. So you can create them yourself and they'll work just as well.
Just create a token called $charting.layout.splitSeries$
, with the right value. You can create it using a Checkbox module, or a Pulldown module, or a ResultsValueSetter. I think you came really close with your ResultsValueSetter attempt, except for a typo (splitSeriese
has an extra e on the end there).
I think the easiest is just to use the Checkbox module to create it:
<module name="Checkbox">
<param name="name">charting.layout.splitSeries</param>
<param name="label">split series</param>
<param name="onValue">True</param>
<param name="offValue">False</param>
To quickly explain why this works -- all HiddenChartFormatter does is create a bunch of $foo$ tokens -- $charting.chart$ and $charting.chart.nullValueMode$ etc.. So you can create them yourself and they'll work just as well.
Great, this works. Yes, the extra "e" was a result of a lot of changing around and testing.