All Apps and Add-ons

Splunk 6 Flashtimeline Conversion to Search - Assigning Chart Title

slierninja
Communicator

We used the flashtimeline view heavily in Splunk 5. Now that we are looking to upgrade to Splunk 6 it appears that some of the features are not backwards compatible using the search view that is now redirected from flashtimeline.

Does anyone know how to assign the Chart Title when using the search view? This used to be done via the c.title querystring parameter in Splunk 5 for the flashtimeline view.

Splunk 5 Query (flashtimeline)

http://site:8000/en-US/app/customapp/flashtimeline?q=search&c.chart=bar&c.title=MyCustomTitle&earlie...

Splunk 6 Query (search)

http://site:8000/en-US/app/customapp/search?q=search&c.chart=bar&c.title=MyCustomTitle&earliest=1380...

c.title does not appear anywhere in the chart visualization. I will look in the system source - just curious if anyone else has run into this yet.

0 Karma

Doc_Yes
Splunk Employee
Splunk Employee

In 6.0 the chart axis titles can be layered via GET params (URL):


display.visualizations.charting.axisTitleX.text
display.visualizations.charting.axisTitleY.text

Here's the complete set of visualization URI params that can be layered:


display.visualizations.show
display.visualizations.type
display.visualizations.chartHeight
display.visualizations.charting.chart
display.visualizations.charting.chart.stackMode
display.visualizations.charting.chart.nullValueMode
display.visualizations.charting.drilldown
display.visualizations.charting.chart.style
display.visualizations.charting.layout.splitSeries
display.visualizations.charting.legend.placement
display.visualizations.charting.legend.labelStyle.overflowMode
display.visualizations.charting.axisTitleX.text
display.visualizations.charting.axisTitleY.text
display.visualizations.charting.axisTitleX.visibility
display.visualizations.charting.axisTitleY.visibility
display.visualizations.charting.axisX.scale
display.visualizations.charting.axisY.scale
display.visualizations.charting.axisLabelsX.majorUnit
display.visualizations.charting.axisLabelsY.majorUnit
display.visualizations.charting.axisX.minimumNumber
display.visualizations.charting.axisY.minimumNumber
display.visualizations.charting.axisX.maximumNumber
display.visualizations.charting.axisY.maximumNumber
display.visualizations.charting.chart.sliceCollapsingThreshold
display.visualizations.charting.gaugeColors
display.visualizations.charting.chart.rangeValues
display.visualizations.singlevalue.beforeLabel
display.visualizations.singlevalue.afterLabel
display.visualizations.singlevalue.underLabel

0 Karma

slierninja
Communicator

@Doc-Yes - thanks for sharing the values - however Axis Titles are not the same as Chart Title. Chart Title appears above the Chart to provide context as to what the user is seeing in the graph below it.

0 Karma

arobbins_splunk
Splunk Employee
Splunk Employee

What are you trying to do? Are you trying to provide a title when entering into the search view for a custom workflow?

I don't believe that we still provide for a title specifically for the chart in either the search view or a report. You can, however, save a specific search and chart as a report. When that report is opened in either the report view /app//report or the search view /app//search a title will be prominently displayed for the whole report.

More generally, we did not account for any of the c.* query string arguments when coming into either the search or the report view.

arobbins_splunk
Splunk Employee
Splunk Employee

Another option you could possibly use: make a templatized simple XML page. The first panel could be an HTML panel with $name$, the page level search could be $search$ and the second and third panels could be a chart and table that use the page level search. Check out the Splunk 6 Dashboard Examples App on apps.splunk.com to see a variety of examples (nothing quite like what you're looking for, but enough building blocks to put it together). If you want to explore this method, let me know and I'll point our Simple XML experts at this question.

slierninja
Communicator

Just observed the new report view in Splunk 6...this is exactly what we'd like to use for dynamic viewing of drill-downs. If we had a searchreport that combined the best of both worlds. We have no use for the search bar - but love the heading that report view provides (e.g. search title and description).

0 Karma

slierninja
Communicator

Thank you - we don't like losing the context around how the dynamic charts are generated and represented to the users. This will be a great item to get back. 😉

0 Karma

arobbins_splunk
Splunk Employee
Splunk Employee

Looks like an oversight on our part. I'll add this use case into our planning for future releases.

As to a workaround, I'll forward this to the developers to see if they can figure something out.

slierninja
Communicator

@arobbins_splunk - we have too many dynamic searches to create a report for each view. We have drill-downs from advanced XML dashboards that make use of this chart title extensively for user context. We can't statically define a report for each custom search we create since it's entirely data driven. Is the title something we can add back in our self (overriding the system template) - or do we need to create a custom search template? We'd rather not recreate the parameterized view.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...