Solved: Unable to plot custom Tag Cloud chart in splunk?

Maheshparsi · ‎08-24-2015

Hi ALL,

In the "custom visualizations" app, I need to plot custom Tag cloud chart. But when I have changed the query in the XML, the chart is showing different chart(other than Tag cloud chart as expected). Can any one please help me to get out of this?

Thanks for the solution in advance,

Regards,
Mahesh.

skawasaki_splun · ‎08-25-2015

That's not how you use SimpleXML for custom visualization at all. Please read the Tutorial page of the Custom Visualization app.

The SimpleXML should look like:

<panel>
  <html>
    <h2>Top 100 Most Common Terms in an Ad-hoc Search Query</h2>
    <div id="tagcloud_search" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options='{
      "preview": true,
      "search": "index=_audit NOT REST: search=* | regex search_id=\"&apos;\\d+\\.\\d+&apos;\" | rex field=search max_match=0 \"(?&lt;terms&gt;\\w+)\" | top limit=100 terms | eval r=random() | sort r",
      "earliest_time": {
        "type": "token_safe",
        "value": "$$earliest$$"
      },
      "latest_time": {
        "type": "token_safe",
        "value": "$$latest$$"
      }
    }'>
    </div>
    <div id="tagcloud" class="splunk-view" data-require="app/custom_vizs/components/tagcloud/tagcloud" data-options='{
      "minFontSize": 14,
      "maxFontSize": 55,
      "managerid": "tagcloud_search",
      "valueField": "count",
      "labelField": "terms"
    }'>
    </div>
 </html>
</panel>

View solution in original post

skawasaki_splun · ‎08-25-2015

That's not how you use SimpleXML for custom visualization at all. Please read the Tutorial page of the Custom Visualization app.

The SimpleXML should look like:

<panel>
  <html>
    <h2>Top 100 Most Common Terms in an Ad-hoc Search Query</h2>
    <div id="tagcloud_search" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options='{
      "preview": true,
      "search": "index=_audit NOT REST: search=* | regex search_id=\"&apos;\\d+\\.\\d+&apos;\" | rex field=search max_match=0 \"(?&lt;terms&gt;\\w+)\" | top limit=100 terms | eval r=random() | sort r",
      "earliest_time": {
        "type": "token_safe",
        "value": "$$earliest$$"
      },
      "latest_time": {
        "type": "token_safe",
        "value": "$$latest$$"
      }
    }'>
    </div>
    <div id="tagcloud" class="splunk-view" data-require="app/custom_vizs/components/tagcloud/tagcloud" data-options='{
      "minFontSize": 14,
      "maxFontSize": 55,
      "managerid": "tagcloud_search",
      "valueField": "count",
      "labelField": "terms"
    }'>
    </div>
 </html>
</panel>

skawasaki_splun · ‎08-24-2015

Paste me your SimpleXML code.

Maheshparsi · ‎08-24-2015

Hi skawasaki,
please find the code below:

9.1_Top Web Users Clone

<panel>
  <title>Top Web Users by Hits and Received Bytes</title>
  <table>
    <search>
      <query>source="F:\\Splunk_Log Files\\*" | stats count(dst_ip) as Hits,sum(recv_bytes) as Bytes by src_ip | sort -Hits |head 10| eval Bytes=Bytes." MB"</query>
    </search>
    <option name="wrap">true</option>
    <option name="rowNumbers">true</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">none</option>
    <option name="count">10</option>
  </table>
</panel>

Regards,
Mahesh.

Unable to plot custom Tag Cloud chart in splunk?

Can’t make it to .conf25? Join us online!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Are you a member of the Splunk Community?

Unable to plot custom Tag Cloud chart in splunk?

Can’t make it to .conf25? Join us online!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions