Splunk 6 Flashtimeline Conversion to Search - Assigning Chart Title

[slierninja]

We used the flashtimeline view heavily in Splunk 5. Now that we are looking to upgrade to Splunk 6 it appears that some of the features are not backwards compatible using the search view that is now redirected from flashtimeline.

Does anyone know how to assign the Chart Title when using the search view? This used to be done via the c.title querystring parameter in Splunk 5 for the flashtimeline view.

Splunk 5 Query (flashtimeline)

http://site:8000/en-US/app/customapp/flashtimeline?q=search&c.chart=bar&c.title=MyCustomTitle&earlie...

Splunk 6 Query (search)

http://site:8000/en-US/app/customapp/search?q=search&c.chart=bar&c.title=MyCustomTitle&earliest=1380...

c.title does not appear anywhere in the chart visualization. I will look in the system source - just curious if anyone else has run into this yet.

[Doc_Yes]

In 6.0 the chart axis titles can be layered via GET params (URL):

display.visualizations.charting.axisTitleX.text

display.visualizations.charting.axisTitleY.text

Here's the complete set of visualization URI params that can be layered:

display.visualizations.show

display.visualizations.type

display.visualizations.chartHeight

display.visualizations.charting.chart

display.visualizations.charting.chart.stackMode

display.visualizations.charting.chart.nullValueMode

display.visualizations.charting.drilldown

display.visualizations.charting.chart.style

display.visualizations.charting.layout.splitSeries

display.visualizations.charting.legend.placement

display.visualizations.charting.legend.labelStyle.overflowMode

display.visualizations.charting.axisTitleX.text

display.visualizations.charting.axisTitleY.text

display.visualizations.charting.axisTitleX.visibility

display.visualizations.charting.axisTitleY.visibility

display.visualizations.charting.axisX.scale

display.visualizations.charting.axisY.scale

display.visualizations.charting.axisLabelsX.majorUnit

display.visualizations.charting.axisLabelsY.majorUnit

display.visualizations.charting.axisX.minimumNumber

display.visualizations.charting.axisY.minimumNumber

display.visualizations.charting.axisX.maximumNumber

display.visualizations.charting.axisY.maximumNumber

display.visualizations.charting.chart.sliceCollapsingThreshold

display.visualizations.charting.gaugeColors

display.visualizations.charting.chart.rangeValues

display.visualizations.singlevalue.beforeLabel

display.visualizations.singlevalue.afterLabel

display.visualizations.singlevalue.underLabel

[slierninja]

@Doc-Yes - thanks for sharing the values - however Axis Titles are not the same as Chart Title. Chart Title appears above the Chart to provide context as to what the user is seeing in the graph below it.

[arobbins_splunk]

What are you trying to do? Are you trying to provide a title when entering into the search view for a custom workflow?

I don't believe that we still provide for a title specifically for the chart in either the search view or a report. You can, however, save a specific search and chart as a report. When that report is opened in either the report view /app//report or the search view /app//search a title will be prominently displayed for the whole report.

More generally, we did not account for any of the c.* query string arguments when coming into either the search or the report view.

[arobbins_splunk]

Another option you could possibly use: make a templatized simple XML page. The first panel could be an HTML panel with $name$, the page level search could be $search$ and the second and third panels could be a chart and table that use the page level search. Check out the Splunk 6 Dashboard Examples App on apps.splunk.com to see a variety of examples (nothing quite like what you're looking for, but enough building blocks to put it together). If you want to explore this method, let me know and I'll point our Simple XML experts at this question.

[slierninja]

Just observed the new report view in Splunk 6...this is exactly what we'd like to use for dynamic viewing of drill-downs. If we had a searchreport that combined the best of both worlds. We have no use for the search bar - but love the heading that report view provides (e.g. search title and description).

[slierninja]

Thank you - we don't like losing the context around how the dynamic charts are generated and represented to the users. This will be a great item to get back. 😉

[arobbins_splunk]

Looks like an oversight on our part. I'll add this use case into our planning for future releases.

As to a workaround, I'll forward this to the developers to see if they can figure something out.

[slierninja]

@arobbins_splunk - we have too many dynamic searches to create a report for each view. We have drill-downs from advanced XML dashboards that make use of this chart title extensively for user context. We can't statically define a report for each custom search we create since it's entirely data driven. Is the title something we can add back in our self (overriding the system template) - or do we need to create a custom search template? We'd rather not recreate the parameterized view.